anchor.diff:          type = with types; attrsOf (submodule (secretSvcOpts name config));
           default = {};
         };
  -      plaintextPath = mkOption {
  -        type = types.str;
  +      encryptedPath = mkOption {
  +        type = types.path;
         };
         dummyContents = mkOption {
           type = types.package;
  
positive.code:           stdout.
          '';
        };
        encrypter = mkOption {
          type = types.path;
          description = ''
            Executable that can encrypt a secret. The first argument will be
            the plaintext file. The encrypted ciphertext should be printed on
            stdout. The encrypter will run during the evalutation phase.
          '';
        };
        secrets = mkOption {
          type = with types; attrsOf (submodule secretOpts);
          default = {};
  
negative.code:       echo "copying dummy secret ${secret.dummyContents} to ${path}"
        cat "${secret.dummyContents}" > "${path}"
      '' else ''
        ${cfg.decrypter} "${secret.encryptedPath}" > "${path}"
      ''}
    '';
  
  