anchor.diff:  
       # server
       server = ${cfg.listenHost}:${toString cfg.listenPort}
  -    ${mkConfLine "server.crl" cfg.pki.crl}
  +    ${mkConfLine "server.crl" cfg.pki.server.crl}
   
       # certificates
       ${mkConfLine "trust" cfg.trust}
  
positive.code:   };
  
    pkiOptions = {
      cert = mkPkiOption ''
        Fully qualified path to the server certificate.
      '';
  
      caCert = mkPkiOption ''
        Fully qualified path to the CA certificate.
      '';
  
      crl = mkPkiOption ''
        Fully qualified path to the server certificate revocation list.
      '';
  
      key = mkPkiOption ''
        Fully qualified path to the server key.
      '';
    };
  
    needToCreateCA = all (c: isNull cfg.pki.${c}) (attrNames pkiOptions);
  
    configFile = pkgs.writeText "taskdrc" ''
      # systemd related
  
negative.code:       server.cert = ${cfg.dataDir}/keys/server.cert
        server.key = ${cfg.dataDir}/keys/server.key
      '' else ''
        ca.cert = ${cfg.pki.ca.cert}
        server.cert = ${cfg.pki.server.cert}
        server.key = ${cfg.pki.server.key}
      ''}
    '';
  
  