anchor.diff:        };
   
         privateConfig = mkOption {
  -        type = types.separatedString " ";
  -        default = "";
  +        type = types.str;
  +        default = "/etc/firefox/syncserver-secret.ini";
           description = ''
             If defined, this file would be used to set all fields which were omitted in the
             generated ini files used for configuring the syncserver.  This file is useful
  -          for storing secrets, such as the syncserver.secret or the syncserver.sqluri
  +          for storing secrets, such as the syncserver.secret or the syncserver.sqluri.
  +
  +          If this file does not exists, it would be created with a unique secret.
           '';
         };
       };
  
positive.code: 
  let
    cfg = config.services.firefox.syncserver;
    syncServerSecretFile = "/etc/firefox/syncserver-secret.ini";
    syncServerIni = pkgs.writeText "syncserver.ini" ''
      [DEFAULT]
      overrides = ${cfg.privateConfig} ${syncServerSecretFile}
  
      [server:main]
      use = egg:Paste#http
  
negative.code:       path = [ pkgs.pythonPackages.pasteScript pkgs.coreutils ];
        environment.PYTHONPATH = "${pkgs.pythonPackages.syncserver}/lib/${pkgs.pythonPackages.python.libPrefix}/site-packages";
        preStart = ''
          if ! test -e ${cfg.privateConfig}; then
            umask u=rwx,g=x,o=x
            mkdir -p $(dirname ${cfg.privateConfig})
            echo  > ${cfg.privateConfig} '[syncserver]'
            echo >> ${cfg.privateConfig} "secret = $(head -c 20 /dev/urandom | sha1sum | tr -d ' -')"
          fi
        '';
        serviceConfig.ExecStart = "paster serve ${syncServerIni}";
  