anchor.diff:  
     isFloat = x: match "^[0-9]+(\\.[0-9]+)?$" (toString x) != null;
   
  +  mkKeys = name: opts: pkgs.runCommand "psql-${name}-keys.nix" {} ''
  +    exec >$out
  +
  +    printf '['
  +
  +    ${pkgs.gnugrep}/bin/grep -oE '${config.nixsap.deployment.keyStore}/[^/]+\b' \
  +    ${opts._configureFile} > keys || [ $? -eq 1 ]
  +
  +    while read -r key; do
  +      printf ' "%s"' "$key"
  +    done < keys
  +
  +    printf ' ]'
  +
  +    printf '%s: ' $out >&2
  +    cat $out >&2
  +  '';
  +
     keyrings =
       let
  -      ik = mapAttrsToList (_: i: { "${i.user}" = [ i.server.ssl_key_file ]; } ) instances;
  +      # This requires read-write mode of evaluation:
  +      keys = n: i: if i.extractKeys then import (mkKeys n i) else [];
  +      ik = mapAttrsToList (n: i: { "${i.user}" = [ i.server.ssl_key_file ] ++ keys n i; } ) instances;
       in foldAttrs (l: r: l ++ r) [] ik;
   
     mkService = name: opts:
  
positive.code:     mkDefault mkIf mkOption nameValuePair types ;
  
    inherit (types)
      attrsOf lines listOf nullOr package path str submodule ;
  
    concatNonEmpty = sep: list: concatStringsSep sep (filter (s: s != "") list);
    explicit = filterAttrs (n: v: n != "_module" && v != null);
  
negative.code:           ALTER DATABASE sproxy OWNER TO sproxy;
          '';
        };
        _configureFile = mkOption {
          readOnly = true;
          internal = true;
          default = pkgs.writeText "pgsql-${name}.sql" config.configure;
        };
        extractKeys = mkOption {
          description = ''
            Automatically extract secret keys from the configuration script.
            Experimental.
          '';
          default = true;
          type = bool;
        };
        package = mkOption {
          description = "PostgreSQL package";
          type = package;
  