anchor.diff:        };
       };
   
  +    assertions = with cfg; [
  +      { assertion = (providerKey.public == null && providerKey.secret == null) ||
  +                    (providerKey.secret != null && providerKey.public != null);
  +        message = "The secret and public provider key must be set together.";
  +      }
  +    ];
  +
     };
   
     meta.maintainers = with lib.maintainers; [ rnhmjoj ];
  
positive.code:       dnscrypt-wrapper --gen-cert-file \
          --crypt-secretkey-file=${cfg.providerName}.key \
          --provider-cert-file=${cfg.providerName}.crt \
          --provider-publickey-file=public.key \
          --provider-secretkey-file=secret.key \
          --cert-file-expire-days=${toString cfg.keys.expiration}
      }
  
      cd ${dataDir}
  
      # generate provider keypair (first run only)
      if [ ! -f public.key ] || [ ! -f secret.key ]; then
        dnscrypt-wrapper --gen-provider-keypair
      fi
  
      # generate new keys for rotation
      if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
  
negative.code:       description = ''
          The name that will be given to this DNSCrypt resolver.
          Note: the resolver name must start with <literal>2.dnscrypt-cert.</literal>.
        '';
      };
  
      providerKey.public = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/etc/secrets/public.key";
        description = ''
          The filepath to the provider public key. If not given a new
          provider key pair will be generated on the first run.
        '';
      };
  
      providerKey.secret = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/etc/secrets/secret.key";
        description = ''
          The filepath to the provider secret key. If not given a new
          provider key pair will be generated on the first run.
        '';
      };
  
  