anchor.diff:        systemd.services.alertmanager = {
           wantedBy = [ "multi-user.target" ];
           after    = [ "network.target" ];
  +        preStart = ''
  +           ${lib.getBin pkgs.envsubst}/bin/envsubst -o /tmp/alert-manager-substituted.yaml" \
  +                                                    -i ${alertmanagerYml}"
  +        '';
           serviceConfig = {
             Restart  = "always";
  -          DynamicUser = true;
  +          DynamicUser = true; # implies PrivateTmp
  +          EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
             WorkingDirectory = "/tmp";
             ExecStart = "${cfg.package}/bin/alertmanager" +
               optionalString (length cmdlineArgs != 0) (" \\\n  " +
  
positive.code:     in checkedConfig yml;
  
    cmdlineArgs = cfg.extraFlags ++ [
      "--config.file ${alertmanagerYml}"
      "--web.listen-address ${cfg.listenAddress}:${toString cfg.port}"
      "--log.level ${cfg.logLevel}"
      ] ++ (optional (cfg.webExternalUrl != null)
  
negative.code:           Extra commandline options when launching the Alertmanager.
          '';
        };
  
        environmentFile = mkOption {
          type = types.nullOr types.path;
          default = null;
          example = "/root/alertmanager.env";
          description = ''
            File to load as environment file. Useful to insert secrets
            into the configuration (via envsubst).
          '';
        };
      };
    };
  
  