anchor.diff:          type = with types; attrsOf (submodule secretOpts);
           default = {};
         };
  +      mkDecryptWrapper = mkOption {
  +        type = types.unspecified;
  +        default = mkDecryptWrapper;
  +      };
       };
   
     };
  
positive.code:   topConfig = config;
    cfg = config.crypto;
  
    decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
      #!${bash}/bin/bash
      ${concatMapStrings ({svc,secretName,secret}: ''
        mkdir -p "$(dirname "${svc.path}")"
        touch "${svc.path}"
        chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
        chown "${svc.user}"."${svc.group}" "${svc.path}"
        ${if cfg.dummy then ''
          echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
          cat "${secret.dummyContents}" > "${svc.path}"
        '' else if hasPrefix storeDir secret.plaintextPath then ''
          echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
          cat "${secret.plaintextPath}" > "${svc.path}"
        '' else ''
          echo "decrypting ${svc.path}"
          ${cfg.decrypter} "${encryptSecret secret}" > "${svc.path}"
        ''}
      '') (secretsForService svcName)}
    '';
  
    encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  
negative.code:     };
    };
  
    mkDecryptWrapper = secretNames: writeScript "decrypt-wrapper" ''
      #!${bash}/bin/bash
      set -eu
  
      PATH="${utillinux}/bin:$PATH"
  
      if ! [ "$(id -u)" == "0" ]; then
        echo >&2 "You must be root"
        exit 1
      fi
  
      newroot="$(mktemp -d)"
      chmod 0700 "$newroot"
  
      function cleanup() {
        umount -l "$newroot"/{dev/pts,dev/shm,dev,nix/store,proc,sys,var,etc,root,run}
        rm -rf "$newroot"
      }
  
      mkdir "$newroot/secrets"
      for d in nix/store dev dev/pts dev/shm proc sys var etc root; do
        mkdir -p "$newroot/$d"
        mount --bind "/$d" "$newroot/$d"
      done
      mkdir -p "$newroot/run"
      mount --rbind "/run" "$newroot/run"
  
      trap cleanup SIGINT SIGTERM EXIT
  
      chroot "$newroot" "${writeScript "wrapped" ''
        #!${bash}/bin/bash
        set -eu
        ${concatMapStrings (s: let secret = cfg.secrets.${s}; in
          decryptSecretScript {
            inherit secret;
            path = "/secrets/${s}";
            user = "root";
            group = "root";
          }
        ) secretNames}
        exec "$@"
      ''}" "$@"
    '';
  
  
  in {
  
    options = {
  