anchor.diff:            pkgs.writeText "prometheus.yml" cfg.configText
           else generatedPrometheusYml;
       in
  -    promtoolCheck "check config" "prometheus.yml" yml;
  +    promtoolCheck "check config ${lib.optionalString (cfg.checkConfig == "syntax-only") "--syntax-only"}" "prometheus.yml" yml;
   
     cmdlineArgs = cfg.extraFlags ++ [
       "--storage.tsdb.path=${workingDir}/data/"
  
positive.code:     };
  
      checkConfig = mkOption {
        type = types.bool;
        default = true;
        description = ''
          Check configuration with <literal>promtool
          check</literal>. The call to <literal>promtool</literal> is
          subject to sandboxing by Nix. When credentials are stored in
          external files (<literal>password_file</literal>,
          <literal>bearer_token_file</literal>, etc), they will not be
          visible to <literal>promtool</literal> and it will report
          errors, despite a correct configuration.
        '';
      };
  
  
negative.code: 
    # a wrapper that verifies that the configuration is valid
    promtoolCheck = what: name: file:
      if checkConfigEnabled then
        pkgs.runCommandLocal
          "${name}-${replaceStrings [" "] [""] what}-checked"
          { buildInputs = [ cfg.package ]; } ''
  