anchor.diff:        };
   
         adminPassword = mkOption {
  -        description = "Default admin password.";
  +        description = ''
  +          Default admin password.
  +          This option is mutual exclusive with the adminPasswordFile option.
  +        '';
           default = "admin";
           type = types.str;
  +      };
  +
  +      adminPasswordFile = mkOption {
  +        description = ''
  +          Default admin password.
  +          This option is mutual exclusive with the <literal>adminPassword</literal> option.
  +        '';
  +        default = null;
  +        type = types.nullOr types.path;
         };
   
         secretKey = mkOption {
           description = "Secret key used for signing.";
           default = "SW2YcwTIb9zpOOhoPsMm";
           type = types.str;
  +      };
  +
  +      secretKeyFile = mkOption {
  +        description = "Secret key used for signing.";
  +        default = null;
  +        type = types.nullOr types.path;
         };
       };
   
  
positive.code:       environment = {
          QT_QPA_PLATFORM = "offscreen";
        } // mapAttrs' (n: v: nameValuePair "GF_${n}" (toString v)) envOptions;
        serviceConfig = {
          ExecStart = "${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}";
          WorkingDirectory = cfg.dataDir;
          User = "grafana";
        };
  
negative.code:       };
  
        password = mkOption {
          description = ''
            Database password.
            This option is mutual exclusive with the passwordFile option.
          '';
          default = "";
          type = types.str;
        };
  
        passwordFile = mkOption {
          description = ''
            File that containts the database password.
            This option is mutual exclusive with the password option.
          '';
          default = null;
          type = types.nullOr types.path;
        };
  
        path = mkOption {
  