anchor.diff:              type = types.str;
               description = ''
                 server secret for safe session cookies, must be set.
  +
  +              Warning: this secret is stored in the WORLD-READABLE Nix store!
  +
  +              It's recommended to use <option>secretKeyFile</option>
  +              which takes precedence over <option>secretKey</option>.
                 '';
               default = "";
  +          };
  +
  +          secretKeyFile = mkOption {
  +            type = types.nullOr types.str;
  +            default = null;
  +            description = ''
  +              A file that contains the server secret for safe session cookies, must be set.
  +
  +              <option>secretKeyFile</option> takes precedence over <option>secretKey</option>.
  +
  +              Warning: when <option>secretKey</option> is non-empty <option>secretKeyFile</option>
  +              defaults to a file in the WORLD-READABLE Nix store containing that secret.
  +              '';
             };
   
             workDir = mkOption {
  
positive.code:           };
  
          };
        }));
      };
    };
  
    config = mkIf cfg.enable {
      environment.systemPackages = [ bepasty ];
  
      # creates gunicorn systemd service for each configured server
  
negative.code:               cat > ${server.workDir}/bepasty-${name}.conf <<EOF
                SITENAME="${name}"
                STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
                SECRET_KEY="$(cat "${server.secretKeyFile}")"
                DEFAULT_PERMISSIONS="${server.defaultPermissions}"
                ${server.extraConfig}
                EOF
  