anchor.diff:          example = "network";
           type = types.string;
           description = "members of this group can control hostapd";
  -        };
  +      };
   
         wpa = mkOption {
           default = true;
           description = "enable WPA (IEEE 802.11i/D3.0) to authenticate to the access point";
  -        };
  +      };
   
         wpaPassphrase = mkOption {
           default = "my_sekret";
           example = "any_64_char_string";
           type = types.string;
  -        description = "WPA-PSK (pre-shared-key) passphrase. Clients will need this passphrase to associate with this access point";
  -        };
  +        description = 
  +          ''
  +          WPA-PSK (pre-shared-key) passphrase. Clients will need this
  +          passphrase to associate with this access point. Warning: This passphrase will
  +          get put into a world-readable file in the nix store. 
  +          '';
  +      };
   
         extraCfg = mkOption {
           default = "";
  
positive.code:           '';
          type = types.string;
          description = "Extra configuration options to put in the hostapd.conf";
          };
        };
      };
  
  
    ###### implementation
  
negative.code:       enable = mkOption {
          default = false;
          description = ''
            Enable putting a wireless interface into infrastructure mode,
            allowing other wireless devices to associate with the wireless interface and do
            wireless networking. A simple access point will enable hostapd.wpa, and
            hostapd.wpa_passphrase, hostapd.ssid, dhcpd on the wireless interface to
  