anchor.diff:      touch "${svc.path}"
       chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
       chown "${svc.user}"."${svc.group}" "${svc.path}"
  -    echo "decrypting ${svc.path}"
  -    ${config.crypto.decrypter} "${encryptSecret secret}" > "${svc.path}"
  +    ${if cfg.dummy then ''
  +      echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
  +      cat "${secret.dummyContents}" > "${svc.path}"
  +    '' else if hasPrefix storeDir secret.plaintextPath then ''
  +      echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
  +      cat "${secret.plaintextPath}" > "${svc.path}"
  +    '' else ''
  +      echo "decrypting ${svc.path}"
  +      ${config.crypto.decrypter} "${encryptSecret secret}" > "${svc.path}"
  +    ''}
     '';
   
     encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  
positive.code: let
  
    topConfig = config;
  
    decryptSecretScript = secret: svc: writeScript "decrypt-secret" ''
      #!${bash}/bin/bash
  
negative.code:       };
        plaintextPath = mkOption {
          type = types.str;
        };
        dummyContents = mkOption {
          type = types.package;
        };
      };
    };
  