anchor.diff:        dnscrypt-wrapper --gen-cert-file \
           --crypt-secretkey-file=${cfg.providerName}.key \
           --provider-cert-file=${cfg.providerName}.crt \
  -        --provider-publickey-file=public.key \
  -        --provider-secretkey-file=secret.key \
  +        --provider-publickey-file=${publicKey} \
  +        --provider-secretkey-file=${secretKey} \
           --cert-file-expire-days=${toString cfg.keys.expiration}
       }
   
       cd ${dataDir}
   
       # generate provider keypair (first run only)
  -    if [ ! -f public.key ] || [ ! -f secret.key ]; then
  -      dnscrypt-wrapper --gen-provider-keypair
  -    fi
  +    ${optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
  +      if [ ! -f ${publicKey} ] || [ ! -f ${secretKey} ]; then
  +        dnscrypt-wrapper --gen-provider-keypair
  +      fi
  +    ''}
   
       # generate new keys for rotation
       if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
  
positive.code:       description = ''
          The name that will be given to this DNSCrypt resolver.
          Note: the resolver name must start with <literal>2.dnscrypt-cert.</literal>.
        '';
      };
  
  
negative.code:       };
      };
  
      assertions = with cfg; [
        { assertion = (providerKey.public == null && providerKey.secret == null) ||
                      (providerKey.secret != null && providerKey.public != null);
          message = "The secret and public provider key must be set together.";
        }
      ];
  
    };
  
    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
  