anchor.diff:  
     preStart = ''
       install --owner ddclient -m600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
  -    ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
  +    ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
  +      install --owner ddclient -m600 ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
  +    '' else if (cfg.passwordFile != null) then ''
         password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
         sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf
       '' else ''
  
positive.code:         default = null;
          type = nullOr str;
          description = ''
            A file containing the password.
          '';
        };
  
  
negative.code:       };
  
        username = mkOption {
          # For `nsupdate` username contains the path to the nsupdate executable
          default = lib.optionalString (config.services.ddclient.protocol == "nsupdate") "${pkgs.bind.dnsutils}/bin/nsupdate";
          defaultText = "";
          type = str;
          description = ''
            User name.
  