anchor.diff:          '';
         };
   
  +      environmentFile = mkOption {
  +        type = types.nullOr types.path;
  +        default = null;
  +        example = "/run/secrets/wireless.env";
  +        description = ''
  +          File consisting of lines of the form <literal>varname=value</literal>
  +          to define variables for the wireless configuration.
  +
  +          See section "EnvironmentFile=" in <citerefentry>
  +          <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
  +          </citerefentry> for a syntax reference.
  +
  +          Secrets (PSKs, passwords, etc.) can be provided without adding them to
  +          the world-readable Nix store by defining them in the environment file and
  +          referring to them in option <option>networking.wireless.networks</option>
  +          with the syntax <literal>@varname@</literal>. Example:
  +
  +          <programlisting>
  +          # content of /run/secrets/wireless.env
  +          PSK_HOME=mypassword
  +          PASS_WORK=myworkpassword
  +          </programlisting>
  +
  +          <programlisting>
  +          # wireless-related configuration
  +          networking.wireless.environmentFile = "/run/secrets/wireless.env";
  +          networking.wireless.networks = {
  +            home.psk = "@PSK_HOME@";
  +            work.auth = '''
  +              eap=PEAP
  +              identity="my-user@example.com"
  +              password="@PASS_WORK@"
  +            ''';
  +          };
  +          </programlisting>
  +        '';
  +      };
  +
         networks = mkOption {
           type = types.attrsOf (types.submodule {
             options = {
  
positive.code:         default = {};
          example = literalExample ''
            { echelon = {                   # SSID with no spaces or special characters
                psk = "abcdefgh";
              };
              "echelon's AP" = {            # SSID with spaces and/or special characters
                 psk = "ijklmnop";
              };
              "free.wifi" = {};             # Public wireless network
            }
          '';
  
negative.code:     let
        deviceUnit = optional (iface != null) "sys-subsystem-net-devices-${utils.escapeSystemdPath iface}.device";
        configStr = if cfg.allowAuxiliaryImperativeNetworks
          then "-c /etc/wpa_supplicant.conf -I ${finalConfig}"
          else "-c ${finalConfig}";
      in {
        description = "WPA Supplicant instance" + optionalString (iface != null) " for interface ${iface}";
  
  