anchor.diff:          type = types.listOf types.package;
         };
   
  -      token = mkOption {
  -        type = types.str;
  +      tokenPath = mkOption {
  +        type = types.path;
           description = ''
             The token from your Buildkite "Agents" page.
  +
  +          A run-time path to the token file, which is supposed to be provisioned
  +          outside of Nix store.
           '';
         };
   
  
positive.code:           HOME = cfg.dataDir;
            NIX_REMOTE = "daemon";
          };
          preStart = ''
            ${pkgs.coreutils}/bin/mkdir -m 0700 -p ${cfg.dataDir}/.ssh
  
            echo "${cfg.openssh.privateKey}" > ${cfg.dataDir}/.ssh/id_rsa
            ${pkgs.coreutils}/bin/chmod 600 ${cfg.dataDir}/.ssh/id_rsa
  
            echo "${cfg.openssh.publicKey}" > ${cfg.dataDir}/.ssh/id_rsa.pub
            ${pkgs.coreutils}/bin/chmod 600 ${cfg.dataDir}/.ssh/id_rsa.pub
          '';
  
          serviceConfig =
            { ExecStart = "${pkgs.buildkite-agent}/bin/buildkite-agent start --config ${configFile}";
              User = "buildkite-agent";
              RestartSec = 5;
              Restart = "on-failure";
  
negative.code:         home = cfg.dataDir;
          createHome = true;
          description = "Buildkite agent user";
          extraGroups = [ "keys" ];
        };
  
      environment.systemPackages = [ cfg.package ];
  
      systemd.services.buildkite-agent =
        let copy = x: target: perms:
                   "cp -f ${x} ${target}; ${pkgs.coreutils}/bin/chmod ${toString perms} ${target}; ";
        in
        { description = "Buildkite Agent";
          wantedBy = [ "multi-user.target" ];
          after = [ "network.target" ];
  