anchor.diff:              || (lists.count (v: v.enable) (attrsets.attrValues acfg.objectstore)) == 1;
             message = "If using objectstore class as primary storage exactly one class can be enabled.";
           }
  -        { assertion = let s3 = acfg.objectstore.s3; in acfg.objectstore == null
  -            || (!s3.enable || ((s3.arguments.secret != null) != (s3.arguments.secretFile != null)));
  -          message = "S3 storage requires specifying exactly one of secret or secretFile";
  -        }
         ];
   
         warnings = let
  
positive.code:           c = cfg.config;
            writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
            requiresReadSecretFunction = c.dbpassFile != null
              || (c.objectstore != null && (c.objectstore.s3.enable && c.objectstore.s3.arguments.secretFile != null));
            objectstoreConfig = let
              class = if c.objectstore.s3.enable then "S3" else "";
              args = if c.objectstore.s3.enable then c.objectstore.s3.arguments else {};
  
negative.code:               'bucket' => '${args.bucket}',
                'autocreate' => ${toString args.autocreate},
                'key' => '${args.key}',
                'secret' => nix_read_secret('${args.secretFile}'),
                ${optionalString (args.hostname != null) "'hostname' => '${args.hostname}',"}
                ${optionalString (args.port != null) "'port' => ${toString args.port},"}
                ${optionalString (args.useSsl != null) "'use_ssl' => ${if args.useSsl then "true" else "false"},"}
  