anchor.diff:        path = [ pkgs.pythonPackages.pasteScript pkgs.coreutils ];
         environment.PYTHONPATH = "${pkgs.pythonPackages.syncserver}/lib/${pkgs.pythonPackages.python.libPrefix}/site-packages";
         preStart = ''
  -        if ! test -e ${syncServerSecretFile}; then
  -          mkdir -p $(dirname ${syncServerSecretFile})
  -          echo  > ${syncServerSecretFile} '[syncserver]'
  -          echo >> ${syncServerSecretFile} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
  +        if ! test -e ${cfg.privateConfig}; then
  +          umask u=rwx,g=x,o=x
  +          mkdir -p $(dirname ${cfg.privateConfig})
  +          echo  > ${cfg.privateConfig} '[syncserver]'
  +          echo >> ${cfg.privateConfig} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
           fi
         '';
         serviceConfig.ExecStart = "paster serve ${syncServerIni}";
  
positive.code:       };
  
        privateConfig = mkOption {
          type = types.separatedString " ";
          default = "";
          description = ''
            If defined, this file would be used to set all fields which were omitted in the
            generated ini files used for configuring the syncserver.  This file is useful
            for storing secrets, such as the syncserver.secret or the syncserver.sqluri
          '';
        };
      };
  
negative.code: 
  let
    cfg = config.services.firefox.syncserver;
    syncServerIni = pkgs.writeText "syncserver.ini" ''
      [DEFAULT]
      overrides = ${cfg.privateConfig}
  
      [server:main]
      use = egg:Paste#http
  