anchor.diff:                  };
                 };
               });
  +          };
  +
  +          preOpenCommands = mkOption {
  +            type = types.lines;
  +            default = "";
  +            example = ''
  +              mkdir -p /tmp/persistent
  +              mount -t zfs rpool/safe/persistent /tmp/persistent
  +            '';
  +            description = ''
  +              Commands that should be run right before we try to mount our LUKS device.
  +              This can be useful, if the keys needed to open the drive is on another partion.
  +            '';
  +          };
  +
  +          postOpenCommands = mkOption {
  +            type = types.lines;
  +            default = "";
  +            example = ''
  +              umount /tmp/persistent
  +            '';
  +            description = ''
  +              Commands that should be run right after we have mounted our LUKS device.
  +            '';
             };
           };
         }));
  
positive.code:     }
      ''}
  
      ${if (luks.yubikeySupport && (yubikey != null)) || (luks.gpgSupport && (gpgCard != null)) || (luks.fido2Support && (fido2.credential != null)) then ''
      open_with_hardware
      '' else ''
      open_normally
      ''}
    '';
  
    askPass = pkgs.writeScriptBin "cryptsetup-askpass" ''
  
negative.code:     umount /crypt-ramfs 2>/dev/null
    '';
  
    openCommand = name': { name, device, header, keyFile, keyFileSize, keyFileOffset, allowDiscards, yubikey, gpgCard, fido2, fallbackToPassword, preOpenCommands, postOpenCommands,... }: assert name' == name;
    let
      csopen   = "cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} ${optionalString (header != null) "--header=${header}"}";
      cschange = "cryptsetup luksChangeKey ${device} ${optionalString (header != null) "--header=${header}"}";
  