anchor.diff:        ''}
       ${cfg.extraConfig}
     '';
  +
  +  allConfigPaths = [configFile] ++ cfg.extraConfigPaths;
  +
  +  configOptions = escapeShellArgs (concatMap (p: ["-config" p]) allConfigPaths);
  +
   in
   
   {
  
positive.code:       serviceConfig = {
          User = "vault";
          Group = "vault";
          ExecStart = "${cfg.package}/bin/vault server -config ${configFile}";
          ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
          PrivateDevices = true;
          PrivateTmp = true;
  
negative.code:       storageConfig = mkOption {
          type = types.nullOr types.lines;
          default = null;
          description = ''
            HCL configuration to insert in the storageBackend section.
  
            Confidential values should not be specified here because this option's
            value is written to the Nix store, which is publicly readable.
            Provide credentials and such in a separate file using
            <xref linkend="opt-services.vault.extraConfigPaths"/>.
          '';
        };
  
        telemetryConfig = mkOption {
  