anchor.diff:      };
     };
   
  +  mkDecryptWrapper = secretNames: writeScript "decrypt-wrapper" ''
  +    #!${bash}/bin/bash
  +    set -eu
  +
  +    PATH="${utillinux}/bin:$PATH"
  +
  +    if ! [ "$(id -u)" == "0" ]; then
  +      echo >&2 "You must be root"
  +      exit 1
  +    fi
  +
  +    newroot="$(mktemp -d)"
  +    chmod 0700 "$newroot"
  +
  +    function cleanup() {
  +      umount -l "$newroot"/{dev/pts,dev/shm,dev,nix/store,proc,sys,var,etc,root,run}
  +      rm -rf "$newroot"
  +    }
  +
  +    mkdir "$newroot/secrets"
  +    for d in nix/store dev dev/pts dev/shm proc sys var etc root; do
  +      mkdir -p "$newroot/$d"
  +      mount --bind "/$d" "$newroot/$d"
  +    done
  +    mkdir -p "$newroot/run"
  +    mount --rbind "/run" "$newroot/run"
  +
  +    trap cleanup SIGINT SIGTERM EXIT
  +
  +    chroot "$newroot" "${writeScript "wrapped" ''
  +      #!${bash}/bin/bash
  +      set -eu
  +      ${concatMapStrings (s: let secret = cfg.secrets.${s}; in
  +        decryptSecretScript {
  +          inherit secret;
  +          path = "/secrets/${s}";
  +          user = "root";
  +          group = "root";
  +        }
  +      ) secretNames}
  +      exec "$@"
  +    ''}" "$@"
  +  '';
  +
  +
   in {
   
     options = {
  
positive.code:   topConfig = config;
    cfg = config.crypto;
  
    decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
      #!${bash}/bin/bash
      ${concatMapStrings ({svc,secretName,secret}: ''
        mkdir -p "$(dirname "${svc.path}")"
        touch "${svc.path}"
        chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
        chown "${svc.user}"."${svc.group}" "${svc.path}"
        ${if cfg.dummy then ''
          echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
          cat "${secret.dummyContents}" > "${svc.path}"
        '' else if hasPrefix storeDir secret.plaintextPath then ''
          echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
          cat "${secret.plaintextPath}" > "${svc.path}"
        '' else ''
          echo "decrypting ${svc.path}"
          ${cfg.decrypter} "${encryptSecret secret}" > "${svc.path}"
        ''}
      '') (secretsForService svcName)}
    '';
  
    encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  
negative.code:         type = with types; attrsOf (submodule secretOpts);
          default = {};
        };
        mkDecryptWrapper = mkOption {
          type = types.unspecified;
          default = mkDecryptWrapper;
        };
      };
  
    };
  