anchor.diff:      }
       ''}
   
  +    # commands to run right before we mount our device
  +    ${preOpenCommands}
  +
       ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) || (luks.fido2Support && (fido2.credential != null)) then ''
       open_with_hardware
       '' else ''
       open_normally
       ''}
  +
  +    # commands to run right after we mounted our device
  +    ${postOpenCommands}
     '';
   
     askPass = pkgs.writeScriptBin "cryptsetup-askpass" ''
  
positive.code:     umount /crypt-ramfs 2>/dev/null
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fido2, fallbackToPassword, ... }: assert name' == name;
    let
      csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
      cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
  
negative.code:                 };
                };
              });
            };
  
            preOpenCommands = mkOption {
              type = types.lines;
              default = "";
              example = ''
                mkdir -p /tmp/persistent
                mount -t zfs rpool/safe/persistent /tmp/persistent
              '';
              description = ''
                Commands that should be run right before we try to mount our LUKS device.
                This can be useful, if the keys needed to open the drive is on another partion.
              '';
            };
  
            postOpenCommands = mkOption {
              type = types.lines;
              default = "";
              example = ''
                umount /tmp/persistent
              '';
              description = ''
                Commands that should be run right after we have mounted our LUKS device.
              '';
            };
          };
        }));
  