anchor.diff:    inherit (builtins)
       attrNames baseNameOf head match pathExists readFile toString ;
     inherit (lib)
  -    foldl genAttrs mapAttrsToList mkOption optionalAttrs types ;
  -  inherit (types)
  +    filter foldl genAttrs hasPrefix mapAttrsToList mkOption
  +    optionalAttrs unique ;
  +  inherit (lib.types)
       attrsOf listOf nullOr path ;
   
     allusers = config.users.users;
  
positive.code:   options.nixsap.deployment = {
      secrets = mkOption {
        description = ''
          Directory with the secrets. If not specified,
          each key will be an empty file.
          '';
        type = nullOr path;
        default = null;
        example = "<secrets>";
      };
      keyrings = mkOption {
        type = attrsOf (listOf path);
        description = ''
          Binds keys to a user. It's possible to share the same key between
          multiple users, of course by different names: "/run/keys/foo" and
          "/run/keys/foo[bar]" will use the same secret file "foo".
        '';
        default = {};
        example = { mysqlbackup = [ "/run/keys/s3cmd.cfg" ];
  
negative.code: 
      deployment.keys = foldl (a: b: a//b) {} (
        mapAttrsToList (name: keys:
          let realkeys = unique (filter (n: n != null && hasPrefix cfg.keyStore n) keys);
          in genAttrs (map baseNameOf realkeys)
                   (key: { text = read key;
                           user = toString allusers.${name}.uid;
                         })
  