anchor.diff:          default = ''
             tls_min_version = "tls12"
           '';
  -        description = "extra configuration";
  +        description = "Extra text appended to the listener section.";
         };
   
         storageBackend = mkOption {
  
positive.code: { config, lib, pkgs, ... }:
  
  with lib;
  let
    cfg = config.services.vault;
  
  
negative.code:         User = "vault";
          Group = "vault";
          PermissionsStartOnly = true;
          ExecStart = "${cfg.package}/bin/vault server -config ${configFile}";
          PrivateDevices = true;
          PrivateTmp = true;
          ProtectSystem = "full";
  