anchor.diff:  
     configFile = name: cfg: ''
       cachedir ${config.services.tarsnap.cachedir}/${name}
  -    keyfile  ${config.services.tarsnap.keyfile}
  +    keyfile  ${cfg.keyfile}
       ${optionalString cfg.nodump "nodump"}
       ${optionalString cfg.printStats "print-stats"}
       ${optionalString cfg.printStats "humanize-numbers"}
  
positive.code:           account.
            Create the keyfile with <command>tarsnap-keygen</command>.
  
            The keyfile name should be given as a string and not a path, to
            avoid the key being copied into the Nix store.
          '';
  
negative.code:         type = types.attrsOf (types.submodule (
            {
              options = {
                keyfile = mkOption {
                  type = types.str;
                  default = config.services.tarsnap.keyfile;
                  description = ''
                    Set a specific keyfile for this archive. This defaults to
                    <literal>"/root/tarsnap.key"</literal> if left unspecified.
  
                    Use this option if you want to run multiple backups
                    concurrently - each archive must have a unique key. You can
                    generate a write-only key derived from your master key (which
                    is recommended) using <literal>tarsnap-keymgmt(1)</literal>.
  
                    Note: every archive must have an individual master key. You
                    must generate multiple keys with
                    <literal>tarsnap-keygen(1)</literal>, and then generate write
                    only keys from those.
  
                    The keyfile name should be given as a string and not a path, to
                    avoid the key being copied into the Nix store.
                  '';
                };
  
                nodump = mkOption {
                  type = types.bool;
                  default = true;
  