anchor.diff:            HOME = cfg.dataDir;
             NIX_REMOTE = "daemon";
           };
  +
  +        ## NB: maximum care is taken so that secrets (ssh keys and the CI token)
  +        ##     don't end up in the Nix store.
           preStart = ''
  -          ${pkgs.coreutils}/bin/mkdir -m 0700 -p ${cfg.dataDir}/.ssh
  +            ${pkgs.coreutils}/bin/mkdir -m 0700 -p ${cfg.dataDir}/.ssh
  +            ${copy (toString cfg.openssh.privateKeyPath) "${cfg.dataDir}/.ssh/id_rsa"     600}
  +            ${copy (toString cfg.openssh.publicKeyPath)  "${cfg.dataDir}/.ssh/id_rsa.pub" 600}
   
  -          echo "${cfg.openssh.privateKey}" > ${cfg.dataDir}/.ssh/id_rsa
  -          ${pkgs.coreutils}/bin/chmod 600 ${cfg.dataDir}/.ssh/id_rsa
  -
  -          echo "${cfg.openssh.publicKey}" > ${cfg.dataDir}/.ssh/id_rsa.pub
  -          ${pkgs.coreutils}/bin/chmod 600 ${cfg.dataDir}/.ssh/id_rsa.pub
  -        '';
  +            cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
  +            token="$(cat ${toString cfg.tokenPath})"
  +            name="${cfg.name}"
  +            meta-data="${cfg.meta-data}"
  +            hooks-path="${pkgs.buildkite-agent}/share/hooks"
  +            build-path="${cfg.dataDir}/builds"
  +            bootstrap-script="${pkgs.buildkite-agent}/share/bootstrap.sh"
  +            EOF
  +          '';
   
           serviceConfig =
  -          { ExecStart = "${pkgs.buildkite-agent}/bin/buildkite-agent start --config ${configFile}";
  +          { ExecStart = "${pkgs.buildkite-agent}/bin/buildkite-agent start --config /var/lib/buildkite-agent/buildkite-agent.cfg";
               User = "buildkite-agent";
               RestartSec = 5;
               Restart = "on-failure";
  
positive.code:       };
  
        openssh =
          { privateKey = mkOption {
              type = types.str;
              description = ''
                Private agent key.
              '';
            };
            publicKey = mkOption {
              type = types.str;
              description = ''
                Public agent key.
              '';
            };
          };
  
negative.code:           };
        };
    };
    imports = [
      (mkRenamedOptionModule [ "services" "buildkite-agent" "token" ]                [ "services" "buildkite-agent" "tokenPath" ])
      (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKey" ] [ "services" "buildkite-agent" "openssh" "privateKeyPath" ])
      (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "publicKey" ]  [ "services" "buildkite-agent" "openssh" "publicKeyPath" ])
    ];
  }
  