anchor.diff:  
     preStart = ''
       install --owner ddclient -m600 ${configFile} /run/${RuntimeDirectory}/ddclient.conf
  -    ${lib.optionalString (cfg.configFile == null) (if (cfg.passwordFile != null) then ''
  +    ${lib.optionalString (cfg.configFile == null) (if (cfg.protocol == "nsupdate") then ''
  +      install --owner ddclient -m600 ${cfg.passwordFile} /run/${RuntimeDirectory}/ddclient.key
  +    '' else if (cfg.passwordFile != null) then ''
         password=$(printf "%q" "$(head -n 1 "${cfg.passwordFile}")")
         sed -i "s|^password=$|password=$password|" /run/${RuntimeDirectory}/ddclient.conf
       '' else ''
  
positive.code:     foreground=YES
      use=${cfg.use}
      login=${cfg.username}
      password=
      protocol=${cfg.protocol}
      ${lib.optionalString (cfg.script != "") "script=${cfg.script}"}
      ${lib.optionalString (cfg.server != "") "server=${cfg.server}"}
  
negative.code:         default = null;
          type = nullOr str;
          description = ''
            A file containing the password or a TSIG key in named format when using the nsupdate protocol.
          '';
        };
  
  