anchor.diff:          ${optionalString (cfg.security.secretKeyFile != null) ''
             export GF_SECURITY_SECRET_KEY="$(cat ${escapeShellArg cfg.security.secretKeyFile})"
           ''}
  +        ${optionalString (cfg.smtp.passwordFile != null) ''
  +          export GF_SMTP_PASSWORD="$(cat ${escapeShellArg cfg.smtp.passwordFile})"
  +        ''}
           exec ${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}
  +      '';
         serviceConfig = {
           WorkingDirectory = cfg.dataDir;
           User = "grafana";
  
positive.code:         description = "Secret key used for signing.";
          default = null;
          type = types.nullOr types.path;
        };
      };
  
  
negative.code:     AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
  
      ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
  
      SMTP_ENABLE = boolToString cfg.smtp.enable;
      SMTP_HOST = cfg.smtp.host;
      SMTP_USER = cfg.smtp.user;
      SMTP_PASSWORD = cfg.smtp.password;
      SMTP_FROM_ADDRESS = cfg.smtp.fromAddress;
    } // cfg.extraOptions;
  
  in {
  