anchor.diff:        stopIfChanged = false;
   
         path = [ package ];
  +      serviceConfig.RuntimeDirectory = "wpa_supplicant";
  +      serviceConfig.RuntimeDirectoryMode = "700";
  +      serviceConfig.EnvironmentFile = mkIf (cfg.environmentFile != null)
  +        (builtins.toString cfg.environmentFile);
   
         script =
         ''
  -        if [ -f /etc/wpa_supplicant.conf -a "/etc/wpa_supplicant.conf" != "${configFile}" ]; then
  -          echo >&2 "<3>/etc/wpa_supplicant.conf present but ignored. Generated ${configFile} is used instead."
  -        fi
  +        ${optionalString configIsGenerated ''
  +          if [ -f /etc/wpa_supplicant.conf ]; then
  +            echo >&2 "<3>/etc/wpa_supplicant.conf present but ignored. Generated ${configFile} is used instead."
  +          fi
  +        ''}
  +
  +        # substitute environment variables
  +        ${pkgs.gawk}/bin/awk '{
  +          for(varname in ENVIRON)
  +            gsub("@"varname"@", ENVIRON[varname])
  +          print
  +        }' "${configFile}" > "${finalConfig}"
   
           iface_args="-s ${optionalString cfg.dbusControlled "-u"} -D${cfg.driver} ${configStr}"
   
  
positive.code:         default = {};
          example = literalExample ''
            { echelon = {                   # SSID with no spaces or special characters
                psk = "abcdefgh";
              };
              "echelon's AP" = {            # SSID with spaces and/or special characters
                 psk = "ijklmnop";
              };
              "free.wifi" = {};             # Public wireless network
            }
          '';
  
negative.code:                 </citerefentry>
                  for example configurations.
  
                  <warning><para>
                    Be aware that this will be written to the nix store
                    in plaintext! Use an environment variable for secrets.
                  </para></warning>
  
                  <note><para>
                    Mutually exclusive with <varname>psk</varname> and
                    <varname>pskRaw</varname>.
                  </para></note>
                '';
              };
  
  