anchor.diff:        };
   
         adminPassword = mkOption {
  -        description = "Default admin password.";
  +        description = ''
  +          Default admin password.
  +          This option is mutual exclusive with the adminPasswordFile option.
  +        '';
           default = "admin";
           type = types.str;
  +      };
  +
  +      adminPasswordFile = mkOption {
  +        description = ''
  +          Default admin password.
  +          This option is mutual exclusive with the <literal>adminPassword</literal> option.
  +        '';
  +        default = null;
  +        type = types.nullOr types.path;
         };
   
         secretKey = mkOption {
           description = "Secret key used for signing.";
           default = "SW2YcwTIb9zpOOhoPsMm";
           type = types.str;
  +      };
  +
  +      secretKeyFile = mkOption {
  +        description = "Secret key used for signing.";
  +        default = null;
  +        type = types.nullOr types.path;
         };
       };
   
  
positive.code:       environment = {
          QT_QPA_PLATFORM = "offscreen";
        } // mapAttrs' (n: v: nameValuePair "GF_${n}" (toString v)) envOptions;
        serviceConfig = {
          ExecStart = "${cfg.package.bin}/bin/grafana-server -homepath ${cfg.dataDir}";
          WorkingDirectory = cfg.dataDir;
          User = "grafana";
        };
  
negative.code: 
      environment.systemPackages = [ cfg.package ];
  
      assertions = [
        {
          assertion = cfg.database.password != opt.database.password.default -> cfg.database.passwordFile == null;
          message = "Cannot set both password and passwordFile";
        }
        {
          assertion = cfg.security.adminPassword != opt.security.adminPassword.default -> cfg.security.adminPasswordFile == null;
          message = "Cannot set both adminPassword and adminPasswordFile";
        }
        {
          assertion = cfg.security.secretKeyFile != opt.security.secretKeyFile.default -> cfg.security.secretKeyFile == null;
          message = "Cannot set both secretKey and secretKeyFile";
        }
      ];
  
      systemd.services.grafana = {
        description = "Grafana Service Daemon";
        wantedBy = ["multi-user.target"];
  