anchor.diff:    topConfig = config;
     cfg = config.crypto;
   
  -  decryptSecretScript = secret: svc: writeScript "decrypt-secret" ''
  +  decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
       #!${bash}/bin/bash
  -    mkdir -p "$(dirname "${svc.path}")"
  -    touch "${svc.path}"
  -    chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
  -    chown "${svc.user}"."${svc.group}" "${svc.path}"
  -    ${if cfg.dummy then ''
  -      echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
  -      cat "${secret.dummyContents}" > "${svc.path}"
  -    '' else if hasPrefix storeDir secret.plaintextPath then ''
  -      echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
  -      cat "${secret.plaintextPath}" > "${svc.path}"
  -    '' else ''
  -      echo "decrypting ${svc.path}"
  -      ${config.crypto.decrypter} "${encryptSecret secret}" > "${svc.path}"
  -    ''}
  +    ${concatMapStrings ({svc,secretName,secret}: ''
  +      mkdir -p "$(dirname "${svc.path}")"
  +      touch "${svc.path}"
  +      chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
  +      chown "${svc.user}"."${svc.group}" "${svc.path}"
  +      ${if cfg.dummy then ''
  +        echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
  +        cat "${secret.dummyContents}" > "${svc.path}"
  +      '' else if hasPrefix storeDir secret.plaintextPath then ''
  +        echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
  +        cat "${secret.plaintextPath}" > "${svc.path}"
  +      '' else ''
  +        echo "decrypting ${svc.path}"
  +        ${cfg.decrypter} "${encryptSecret secret}" > "${svc.path}"
  +      ''}
  +    '') (secretsForService svcName)}
     '';
   
     encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  
positive.code: 
    config = mkIf (config.crypto.secrets != {}) {
      systemd.services = mkMerge (
        [dependentServices] ++ decryptServices ++ purgeOldSecrets
      );
    };
  
  
negative.code:     phases = [ "buildPhase" ];
      preferLocalBuild = true;
      buildPhase = ''
        ${cfg.encrypter} "${secret.plaintextPath}" > "$out"
      '';
    }));
  
  