anchor.diff:  
   let
     cfg = config.services.grafana;
  +  opt = options.services.grafana;
   
     envOptions = {
       PATHS_DATA = cfg.dataDir;
  
positive.code:         ${optionalString (cfg.security.secretKeyFile != null) ''
            export GF_SECURITY_SECRET_KEY="$(cat ${escapeShellArg cfg.security.secretKeyFile})"
          ''}
          exec ${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}
        serviceConfig = {
          WorkingDirectory = cfg.dataDir;
          User = "grafana";
  
negative.code:     AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
  
      ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
  
      SMTP_ENABLE = boolToString cfg.smtp.enable;
      SMTP_HOST = cfg.smtp.host;
      SMTP_USER = cfg.smtp.user;
      SMTP_PASSWORD = cfg.smtp.password;
      SMTP_FROM_ADDRESS = cfg.smtp.fromAddress;
    } // cfg.extraOptions;
  
  in {
  