anchor.diff:          type = with types; attrsOf (submodule (secretSvcOpts name config));
           default = {};
         };
  -      plaintextPath = mkOption {
  -        type = types.str;
  +      encryptedPath = mkOption {
  +        type = types.path;
         };
         dummyContents = mkOption {
           type = types.package;
  
positive.code:     ) (secretsForService svcName)}
    '';
  
    encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
      name = "encryptedsecret";
      phases = [ "buildPhase" ];
      preferLocalBuild = true;
      buildPhase = ''
        ${cfg.encrypter} "${secret.plaintextPath}" > "$out"
      '';
    }));
  
    secretSvcOpts = secretName: secret: { name, config, ... }: {
      options = {
        path = mkOption {
  
negative.code:           stdout.
          '';
        };
        secrets = mkOption {
          type = with types; attrsOf (submodule secretOpts);
          default = {};
  