anchor.diff:    options = {
   
       crypto = {
  +      dummy = mkOption {
  +        type = types.bool;
  +        default = false;
  +      };
         decrypter = mkOption {
           type = types.path;
           description = ''
  
positive.code:     touch "${svc.path}"
      chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
      chown "${svc.user}"."${svc.group}" "${svc.path}"
      echo "decrypting ${svc.path}"
      ${config.crypto.decrypter} "${encryptSecret secret}" > "${svc.path}"
    '';
  
    encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  
negative.code:       };
        plaintextPath = mkOption {
          type = types.str;
        };
        dummyContents = mkOption {
          type = types.package;
        };
      };
    };
  