anchor.diff:    };
   
     pkiOptions = {
  -    cert = mkPkiOption ''
  +    ca.cert = mkPkiOption ''
  +      Fully qualified path to the CA certificate.
  +    '';
  +
  +    server.cert = mkPkiOption ''
         Fully qualified path to the server certificate.
       '';
   
  -    caCert = mkPkiOption ''
  -      Fully qualified path to the CA certificate.
  -    '';
  -
  -    crl = mkPkiOption ''
  +    server.crl = mkPkiOption ''
         Fully qualified path to the server certificate revocation list.
       '';
   
  -    key = mkPkiOption ''
  +    server.key = mkPkiOption ''
         Fully qualified path to the server key.
       '';
     };
   
  -  needToCreateCA = all (c: isNull cfg.pki.${c}) (attrNames pkiOptions);
  +  needToCreateCA = let
  +    notFound = path: let
  +      dotted = concatStringsSep "." path;
  +    in throw "Can't find option definitions for path `${dotted}'.";
  +    findPkiDefinitions = path: attrs: let
  +      mkSublist = key: val: let
  +        newPath = path ++ singleton key;
  +      in if isOption val
  +         then attrByPath newPath (notFound newPath) cfg.pki
  +         else findPkiDefinitions newPath val;
  +    in flatten (mapAttrsToList mkSublist attrs);
  +  in all isNull (findPkiDefinitions [] pkiOptions);
   
     configFile = pkgs.writeText "taskdrc" ''
       # systemd related
  
positive.code: 
      # server
      server = ${cfg.listenHost}:${toString cfg.listenPort}
      ${mkConfLine "server.crl" cfg.pki.crl}
  
      # certificates
      ${mkConfLine "trust" cfg.trust}
  
negative.code:       server.cert = ${cfg.dataDir}/keys/server.cert
        server.key = ${cfg.dataDir}/keys/server.key
      '' else ''
        ca.cert = ${cfg.pki.ca.cert}
        server.cert = ${cfg.pki.server.cert}
        server.key = ${cfg.pki.server.key}
      ''}
    '';
  
  