anchor.diff:      ) (secretsForService svcName)}
     '';
   
  -  encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  -    name = "encryptedsecret";
  -    phases = [ "buildPhase" ];
  -    preferLocalBuild = true;
  -    buildPhase = ''
  -      ${cfg.encrypter} "${secret.plaintextPath}" > "$out"
  -    '';
  -  }));
  -
     secretSvcOpts = secretName: secret: { name, config, ... }: {
       options = {
         path = mkOption {
  
positive.code:         type = with types; attrsOf (submodule (secretSvcOpts name config));
          default = {};
        };
        plaintextPath = mkOption {
          type = types.str;
        };
        dummyContents = mkOption {
          type = types.package;
  
negative.code:       echo "copying dummy secret ${secret.dummyContents} to ${path}"
        cat "${secret.dummyContents}" > "${path}"
      '' else ''
        ${cfg.decrypter} "${secret.encryptedPath}" > "${path}"
      ''}
    '';
  
  