anchor.diff:              };
   
               password = lib.mkOption {
  -              type = with lib.types; nullOr path;
  -              default = null;
  -              description = ''
  -                The path to a file containing the SMTP server password.
  -              '';
  +              type = with lib.types; nullOr (either path (attrsOf path));
  +              default = null;
  +              description = ''
  +                The SMTP server password.
  +
  +                Always handled as a secret whether the value is
  +                wrapped in a <literal>{ _secret = ...; }</literal>
  +                attrset or not (refer to <xref
  +                linkend="opt-services.parsedmarc.settings" /> for
  +                details).
  +              '';
  +              apply = x: if isAttrs x || x == null then x else { _secret = x; };
               };
   
               from = lib.mkOption {
  
positive.code: let
    cfg = config.services.parsedmarc;
    opt = options.services.parsedmarc;
    ini = pkgs.formats.ini {};
  in
  {
    options.services.parsedmarc = {
  
negative.code:             };
  
              password = lib.mkOption {
                type = with lib.types; nullOr (either path (attrsOf path));
                default = null;
                description = ''
                  The password to use when connecting to Elasticsearch,
                  if required.
  
                  Always handled as a secret whether the value is
                  wrapped in a <literal>{ _secret = ...; }</literal>
                  attrset or not (refer to <xref
                  linkend="opt-services.parsedmarc.settings" /> for
                  details).
                '';
                apply = x: if isAttrs x || x == null then x else { _secret = x; };
              };
  
              ssl = lib.mkOption {
  