anchor.diff:            description = "Path of the underlying block device.";
           };
   
  +        header = mkOption {
  +          default = null;
  +          example = "/root/header.img";
  +          type = types.nullOr types.string;
  +          description = ''
  +            The name of the file or block device that
  +            should be used as header for the encrypted device.
  +          '';
  +        };
  +
           keyFile = mkOption {
             default = null;
             example = "/dev/sdb1";
  
positive.code: 
      open_normally() {
          cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
            ${optionalString (keyFile != null) "--key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}"}
      }
  
  
negative.code: let
    luks = config.boot.initrd.luks;
  
    openCommand = { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, ... }: ''
      # Wait for luksRoot to appear, e.g. if on a usb drive.
      # XXX: copied and adapted from stage-1-init.sh - should be
      # available as a function.
  