anchor.diff:  let
     luks = config.boot.initrd.luks;
   
  -  openCommand = { name, device, allowDiscards, ... }: ''
  +  openCommand = { name, device, keyFile, keyFileSize, allowDiscards, ... }: ''
       # Wait for luksRoot to appear, e.g. if on a usb drive.
       # XXX: copied and adapted from stage-1-init.sh - should be
       # available as a function.
  
positive.code:         echo "ok"
      fi
  
      # open luksRoot and scan for logical volumes
      cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"}
    '';
  
    isPreLVM = f: f.preLVM;
  
negative.code:           example = "/dev/sda2";
            type = types.string;
            description = "Path of the underlying block device.";
          };
  
          keyFile = mkOption {
            default = null;
            example = "/dev/sdb1";
            type = types.nullOr types.string;
            description = ''
              The name of the file (can be a raw device or a partition) that
              should be used as the decryption key for the encrypted device. If
              not specified, you will be prompted for a passphrase instead.
            '';
          };
  
          keyFileSize = mkOption {
            default = null;
            example = 4096;
            type = types.nullOr types.int;
            description = ''
              The size of the key file. Use this if only the beginning of the
              key file should be used as a key (often the case if a raw device
              or partition is used as key file). If not specified, the whole
              <literal>keyFile</literal> will be used decryption, instead of just
              the first <literal>keyFileSize</literal> bytes.
            '';
          };
  
          preLVM = mkOption {
  