anchor.diff:  let
     luks = config.boot.initrd.luks;
   
  -  openCommand = { name, device, ... }: ''
  +  openCommand = { name, device, allowDiscards, ... }: ''
       # Wait for luksRoot to appear, e.g. if on a usb drive.
       # XXX: copied and adapted from stage-1-init.sh - should be
       # available as a function.
  
positive.code:     fi
  
      # open luksRoot and scan for logical volumes
      cryptsetup luksOpen ${device} ${name}
    '';
  
    isPreLVM = f: f.preLVM;
  
negative.code:           type = types.bool;
            description = "Whether the luksOpen will be attempted before LVM scan or after it.";
          };
  
          allowDiscards = mkOption {
            default = false;
            type = types.bool;
            description = ''
              Whether to allow TRIM requests to the underlying device. This option
              has security implications, please read the LUKS documentation before
              activating in.
            '';
          };
  
        };
      };
    };
  