anchor.diff:  let
     luks = config.boot.initrd.luks;
   
  -  openCommand = { name, device, keyFile, keyFileSize, allowDiscards, yubikey, ... }: ''
  +  openCommand = { name, device, header, keyFile, keyFileSize, allowDiscards, yubikey, ... }: ''
       # Wait for luksRoot to appear, e.g. if on a usb drive.
       # XXX: copied and adapted from stage-1-init.sh - should be
       # available as a function.
  
positive.code:           description = "Path of the underlying block device.";
          };
  
          keyFile = mkOption {
            default = null;
            example = "/dev/sdb1";
  
negative.code: 
      open_normally() {
          cryptsetup luksOpen ${device} ${name} ${optionalString allowDiscards "--allow-discards"} \
            ${optionalString (header != null) "--header=${header}"} \
            ${optionalString (keyFile != null) "--key-file=${keyFile} ${optionalString (keyFileSize != null) "--keyfile-size=${toString keyFileSize}"}"}
      }
  
  