anchor.diff:        serviceConfig = {
           User = "vault";
           Group = "vault";
  -        ExecStart = "${cfg.package}/bin/vault server -config ${configFile}";
  +        ExecStart = "${cfg.package}/bin/vault server ${configOptions}";
           ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
           PrivateDevices = true;
           PrivateTmp = true;
  
positive.code:       storageConfig = mkOption {
          type = types.nullOr types.lines;
          default = null;
          description = "Storage configuration";
        };
  
        telemetryConfig = mkOption {
  
negative.code:         type = types.lines;
          default = "";
          description = "Extra text appended to <filename>vault.hcl</filename>.";
        };
  
        extraConfigPaths = mkOption {
          type = types.listOf types.path;
          default = [];
          description = ''
            Configuration files to load besides the immutable one defined by the NixOS module.
            This can be used to avoid putting credentials in the Nix store, which can be read by any user.
  
            Each path can point to a JSON- or HCL-formatted file, or a directory
            to be scanned for files with <literal>.hcl</literal> or
            <literal>.json</literal> extensions.
  
            To upload the confidential file with NixOps, use for example:
  
            <programlisting><![CDATA[
            # https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys
            deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in {
              text = ${"''"}
                storage "postgresql" {
                  connection_url = "postgres://''${db.username}:''${db.password}@host.example.com/exampledb?sslmode=verify-ca"
                }
              ${"''"};
              user = "vault";
            };
            services.vault.extraConfigPaths = ["/run/keys/vault.hcl"];
            services.vault.storageBackend = "postgresql";
            users.users.vault.extraGroups = ["keys"];
            ]]></programlisting>
          '';
        };
      };
    };
  