anchor.diff:          home = cfg.dataDir;
           createHome = true;
           description = "Buildkite agent user";
  +        extraGroups = [ "keys" ];
         };
   
       environment.systemPackages = [ cfg.package ];
   
       systemd.services.buildkite-agent =
  +      let copy = x: target: perms:
  +                 "cp -f ${x} ${target}; ${pkgs.coreutils}/bin/chmod ${toString perms} ${target}; ";
  +      in
         { description = "Buildkite Agent";
           wantedBy = [ "multi-user.target" ];
           after = [ "network.target" ];
  
positive.code:         type = types.listOf types.package;
        };
  
        token = mkOption {
          type = types.str;
          description = ''
            The token from your Buildkite "Agents" page.
          '';
        };
  
  
negative.code:           HOME = cfg.dataDir;
            NIX_REMOTE = "daemon";
          };
  
          ## NB: maximum care is taken so that secrets (ssh keys and the CI token)
          ##     don't end up in the Nix store.
          preStart = ''
              ${pkgs.coreutils}/bin/mkdir -m 0700 -p ${cfg.dataDir}/.ssh
              ${copy (toString cfg.openssh.privateKeyPath) "${cfg.dataDir}/.ssh/id_rsa"     600}
              ${copy (toString cfg.openssh.publicKeyPath)  "${cfg.dataDir}/.ssh/id_rsa.pub" 600}
  
              cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
              token="$(cat ${toString cfg.tokenPath})"
              name="${cfg.name}"
              meta-data="${cfg.meta-data}"
              hooks-path="${pkgs.buildkite-agent}/share/hooks"
              build-path="${cfg.dataDir}/builds"
              bootstrap-script="${pkgs.buildkite-agent}/share/bootstrap.sh"
              EOF
            '';
  
          serviceConfig =
            { ExecStart = "${pkgs.buildkite-agent}/bin/buildkite-agent start --config /var/lib/buildkite-agent/buildkite-agent.cfg";
              User = "buildkite-agent";
              RestartSec = 5;
              Restart = "on-failure";
  