anchor.diff:                description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false)";
               };
   
  -            multiUser = mkOption {
  -              default = false;
  -              type = types.bool;
  -              description = "Whether to allow multiple users to authenticate with a Yubikey";
  -            };
  -
               slot = mkOption {
                 default = 2;
                 type = types.int;
                 description = "Which slot on the Yubikey to challenge";
               };
   
  +            ramfsMountPoint = mkOption {
  +              default = "/crypt-ramfs";
  +              type = types.string;
  +              description = "Path where the ramfs used to update the LUKS key will be mounted in stage-1";
  +            };
  +
               storage = mkOption {
                 type = types.optionSet;
  -              description = "Options related to the authentication record";
  +              description = "Options related to the storing the random UUID";
   
                 options = {
                   device = mkOption {
  
positive.code:         local uuid_r
          local k_user
          local challenge
          local k_blob
          local aes_blob_decrypted
          local checksum_correct
          local checksum
          local uuid_luks
          local user_record
  
          uuid_luks="$(cryptsetup luksUUID ${device} | take 36 | tr -d '-')"
  
          ${optionalString (!yubikey.multiUser) ''
          user_record="$(cat ${yubikey.storage.mountPoint}${yubikey.storage.path})"
          uuid_r="$(echo -n $user_record | take 32)"
          ''}
  
          for try in $(seq 3); do
  
              ${optionalString yubikey.multiUser ''
              local user_id
              echo -n "Enter user id: "
              read -s user_id
              echo
              ''}
  
              ${optionalString yubikey.twoFactor ''
              echo -n "Enter two-factor passphrase: "
  
negative.code:                   default = "/crypt-storage/default";
                    type = types.string;
                    description = ''
                      Absolute path of the random UUID on the unencrypted device with
                      that device's root directory as "/".
                    '';
                  };
  