anchor.diff:          home = cfg.dataDir;
           createHome = true;
           description = "Buildkite agent user";
  +        extraGroups = [ "keys" ];
         };
   
       environment.systemPackages = [ cfg.package ];
   
       systemd.services.buildkite-agent =
  +      let copy = x: target: perms:
  +                 "cp -f ${x} ${target}; ${pkgs.coreutils}/bin/chmod ${toString perms} ${target}; ";
  +      in
         { description = "Buildkite Agent";
           wantedBy = [ "multi-user.target" ];
           after = [ "network.target" ];
  
positive.code:       };
  
        openssh =
          { privateKey = mkOption {
              type = types.str;
              description = ''
                Private agent key.
              '';
            };
            publicKey = mkOption {
              type = types.str;
              description = ''
                Public agent key.
              '';
            };
          };
  
negative.code:         type = types.listOf types.package;
        };
  
        tokenPath = mkOption {
          type = types.path;
          description = ''
            The token from your Buildkite "Agents" page.
  
            A run-time path to the token file, which is supposed to be provisioned
            outside of Nix store.
          '';
        };
  
  