anchor.diff:      phases = [ "buildPhase" ];
       preferLocalBuild = true;
       buildPhase = ''
  -      ${config.crypto.encrypter} "${secret.plaintextPath}" > "$out"
  +      ${cfg.encrypter} "${secret.plaintextPath}" > "$out"
       '';
     }));
   
  
positive.code: 
    config = mkIf (config.crypto.secrets != {}) {
      systemd.services = mkMerge (
        [dependentServices] ++ decryptServices ++ purgeOldSecrets
      );
    };
  
  
negative.code:   topConfig = config;
    cfg = config.crypto;
  
    decryptSecretsScript = svcName: writeScript "decrypt-secrets-${svcName}" ''
      #!${bash}/bin/bash
      ${concatMapStrings ({svc,secretName,secret}: ''
        mkdir -p "$(dirname "${svc.path}")"
        touch "${svc.path}"
        chmod ${if svc.group == "root" then "0400" else "0440"} "${svc.path}"
        chown "${svc.user}"."${svc.group}" "${svc.path}"
        ${if cfg.dummy then ''
          echo "copying dummy secret ${secret.dummyContents} to ${svc.path}"
          cat "${secret.dummyContents}" > "${svc.path}"
        '' else if hasPrefix storeDir secret.plaintextPath then ''
          echo "copying plaintext ${secret.plaintextPath} to ${svc.path}"
          cat "${secret.plaintextPath}" > "${svc.path}"
        '' else ''
          echo "decrypting ${svc.path}"
          ${cfg.decrypter} "${encryptSecret secret}" > "${svc.path}"
        ''}
      '') (secretsForService svcName)}
    '';
  
    encryptSecret = secret: toFile "sec" (readFile (stdenv.mkDerivation {
  