anchor.diff:                'bucket' => '${args.bucket}',
                 'autocreate' => ${toString args.autocreate},
                 'key' => '${args.key}',
  -              ${optionalString (args.secret != null) "'secret' => '${args.secret}',"}
  -              ${optionalString (args.secretFile != null) "'secret' => nix_read_secret('${args.secretFile}'),"}
  +              'secret' => nix_read_secret('${args.secretFile}'),
                 ${optionalString (args.hostname != null) "'hostname' => '${args.hostname}',"}
                 ${optionalString (args.port != null) "'port' => ${toString args.port},"}
                 ${optionalString (args.useSsl != null) "'use_ssl' => ${if args.useSsl then "true" else "false"},"}
  
positive.code:               The access key for the S3 bucket.
              '';
            };
            secret = mkOption {
              type = types.nullOr types.str;
              default = null;
              example = "M5MrXTRjkyMaxXPe2FRXMTfTfbKEnZCu+7uRTVSj";
              description = ''
                The access secret for the S3 bucket. Use
                <literal>secretFile</literal> to avoid this being world-readable
                in the <literal>/nix/store</literal>
              '';
            };
            secretFile = mkOption {
              type = types.nullOr types.str;
              default = null;
              example = "/var/nextcloud-objectstore-s3-secret";
              description = ''
                The full path to a file that contains the access secret. Must be
  
negative.code:           c = cfg.config;
            writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
            requiresReadSecretFunction = c.dbpassFile != null
              || (c.objectstore != null && c.objectstore.s3.enable);
            objectstoreConfig = let
              class = if c.objectstore.s3.enable then "S3" else "";
              args = if c.objectstore.s3.enable then c.objectstore.s3.arguments else {};
  