anchor.diff:                  umask u=rwx,g=,o=
                   cp ${parsedmarcConfig} /run/parsedmarc/parsedmarc.ini
                   chown parsedmarc:parsedmarc /run/parsedmarc/parsedmarc.ini
  -                ${mkSecretReplacement cfg.settings.smtp.password}
  -                ${mkSecretReplacement cfg.settings.imap.password}
  -                ${mkSecretReplacement cfg.settings.elasticsearch.password}
  +                ${secretReplacements}
                 '' + lib.optionalString cfg.provision.localMail.enable ''
                   openssl rand -hex 64 >/run/parsedmarc/dmarc_user_passwd
                   replace-secret '@imap-password@' '/run/parsedmarc/dmarc_user_passwd' /run/parsedmarc/parsedmarc.ini
  
positive.code: let
    cfg = config.services.parsedmarc;
    opt = options.services.parsedmarc;
    ini = pkgs.formats.ini {};
  in
  {
    options.services.parsedmarc = {
  
negative.code:     };
  
      settings = lib.mkOption {
        example = lib.literalExpression ''
          {
            imap = {
              host = "imap.example.com";
              user = "alice@example.com";
              password = { _secret = "/run/keys/imap_password" };
              watch = true;
            };
            splunk_hec = {
              url = "https://splunkhec.example.com";
              token = { _secret = "/run/keys/splunk_token" };
              index = "email";
            };
          }
        '';
        description = ''
          Configuration parameters to set in
          <filename>parsedmarc.ini</filename>. For a full list of
          available parameters, see
          <link xlink:href="https://domainaware.github.io/parsedmarc/#configuration-file" />.
  
          Settings containing secret data should be set to an attribute
          set containing the attribute <literal>_secret</literal> - a
          string pointing to a file containing the value the option
          should be set to. See the example to get a better picture of
          this: in the resulting <filename>parsedmarc.ini</filename>
          file, the <literal>splunk_hec.token</literal> key will be set
          to the contents of the
          <filename>/run/keys/splunk_token</filename> file.
        '';
  
        type = lib.types.submodule {
  