anchor.diff:          type = types.attrsOf (types.submodule (
             {
               options = {
  +              keyfile = mkOption {
  +                type = types.str;
  +                default = config.services.tarsnap.keyfile;
  +                description = ''
  +                  Set a specific keyfile for this archive. This defaults to
  +                  <literal>"/root/tarsnap.key"</literal> if left unspecified.
  +
  +                  Use this option if you want to run multiple backups
  +                  concurrently - each archive must have a unique key. You can
  +                  generate a write-only key derived from your master key (which
  +                  is recommended) using <literal>tarsnap-keymgmt(1)</literal>.
  +
  +                  Note: every archive must have an individual master key. You
  +                  must generate multiple keys with
  +                  <literal>tarsnap-keygen(1)</literal>, and then generate write
  +                  only keys from those.
  +
  +                  The keyfile name should be given as a string and not a path, to
  +                  avoid the key being copied into the Nix store.
  +                '';
  +              };
  +
                 nodump = mkOption {
                   type = types.bool;
                   default = true;
  
positive.code:           account.
            Create the keyfile with <command>tarsnap-keygen</command>.
  
            The keyfile name should be given as a string and not a path, to
            avoid the key being copied into the Nix store.
          '';
  
negative.code: 
    configFile = name: cfg: ''
      cachedir ${config.services.tarsnap.cachedir}/${name}
      keyfile  ${cfg.keyfile}
      ${optionalString cfg.nodump "nodump"}
      ${optionalString cfg.printStats "print-stats"}
      ${optionalString cfg.printStats "humanize-numbers"}
  