anchor.diff:    configFile = pkgs.writeText "vault.hcl" ''
       listener "tcp" {
         address = "${cfg.address}"
  -      tls_cert_file = "${cfg.tlsCertFile}"
  -      tls_key_file = "${cfg.tlsKeyFile}"
  +      ${if (cfg.tlsCertFile == null || cfg.tlsKeyFile == null) then ''
  +          tls_disable = "true"
  +        '' else ''
  +          tls_cert_file = "${cfg.tlsCertFile}"
  +          tls_key_file = "${cfg.tlsKeyFile}"
  +        ''}
         ${cfg.listenerExtraConfig}
       }
       storage "${cfg.storageBackend}" {
  
positive.code:       };
  
        tlsCertFile = mkOption {
          type = types.str;
          default = "/etc/vault/cert.pem";
          example = "/path/to/your/cert.pem";
          description = "TLS certificate file. A self-signed certificate will be generated if file not exists";
        };
  
        tlsKeyFile = mkOption {
          type = types.str;
          default = "/etc/vault/key.pem";
          example = "/path/to/your/key.pem";
          description = "TLS private key file. A self-signed certificate will be generated if file not exists";
        };
  
        listenerExtraConfig = mkOption {
  
negative.code: 
        preStart = optionalString (localDir != null) ''
          install -d -m0700 -o vault -g vault "${localDir}"
        '';
  
        serviceConfig = {
  