anchor.diff:              "${cfg.package}/bin/k3s ${cfg.role}"
             ] ++ (optional cfg.docker "--docker")
             ++ (optional cfg.disableAgent "--disable-agent")
  -          ++ (optional (cfg.role == "agent") "--server ${cfg.serverAddr} ${
  -            if cfg.tokenFile != null then
  -              "--token-file ${cfg.tokenFile}"
  -            else
  -              "--token ${cfg.token}"
  -          }")
  +          ++ (optional (cfg.serverAddr != "") "--server ${cfg.serverAddr}")
  +          ++ (optional (cfg.token != "") "--token ${cfg.token}")
  +          ++ (optional (cfg.tokenFile != null) "--token-file ${cfg.tokenFile}")
  +          ++ (optional (cfg.configPath != null) "--config ${cfg.configPath}")
             ++ [ cfg.extraFlags ]
           );
         };
  
positive.code:       default = false;
        description = "Only run the server. This option only makes sense for a server.";
      };
    };
  
    # implementation
  
negative.code:   config = mkIf cfg.enable {
      assertions = [
        {
          assertion = cfg.role == "agent" -> (cfg.configPath != null || cfg.serverAddr != "");
          message = "serverAddr or configPath (with 'server' key) should be set if role is 'agent'";
        }
        {
          assertion = cfg.role == "agent" -> cfg.configPath != null || cfg.tokenFile != null || cfg.token != "";
          message = "token or tokenFile or configPath (with 'token' or 'token-file' keys) should be set if role is 'agent'";
        }
      ];
  
  