anchor.diff:  
     configFile = name: cfg: ''
       cachedir ${config.services.tarsnap.cachedir}/${name}
  -    keyfile  ${config.services.tarsnap.keyfile}
  +    keyfile  ${cfg.keyfile}
       ${optionalString cfg.nodump "nodump"}
       ${optionalString cfg.printStats "print-stats"}
       ${optionalString cfg.printStats "humanize-numbers"}
  
positive.code:         type = types.attrsOf (types.submodule (
            {
              options = {
                nodump = mkOption {
                  type = types.bool;
                  default = true;
  
negative.code:           account.
            Create the keyfile with <command>tarsnap-keygen</command>.
  
            Note that each individual archive (specified below) may also have its
            own individual keyfile specified. Tarsnap does not allow multiple
            concurrent backups with the same cache directory and key (starting a
            new backup will cause another one to fail). If you have multiple
            archives specified, you should either spread out your backups to be
            far apart, or specify a separate key for each archive. By default
            every archive defaults to using
            <literal>"/root/tarsnap.key"</literal>.
  
            It's recommended for backups that you generate a key for every archive
            using <literal>tarsnap-keygen(1)</literal>, and then generate a
            write-only tarsnap key using <literal>tarsnap-keymgmt(1)</literal>,
            and keep your master key(s) for a particular machine off-site.
  
            The keyfile name should be given as a string and not a path, to
            avoid the key being copied into the Nix store.
          '';
  