anchor.diff:          Type = "simple";
           User = config.ids.uids.cfdyndns;
           Group = config.ids.gids.cfdyndns;
  -        ExecStart = "/bin/sh -c '${pkgs.cfdyndns}/bin/cfdyndns'";
         };
         environment = {
           CLOUDFLARE_EMAIL="${cfg.email}";
  -        CLOUDFLARE_APIKEY="${cfg.apikey}";
           CLOUDFLARE_RECORDS="${concatStringsSep "," cfg.records}";
         };
  +      script = ''
  +        ${optionalString (cfg.apikeyFile != null) ''
  +          export CLOUDFLARE_APIKEY="$(cat ${escapeShellArg cfg.apikeyFile})"
  +        ''}
  +        ${pkgs.cfdyndns}/bin/cfdyndns
  +      '';
       };
   
       users.users = {
  
positive.code:   cfg = config.services.cfdyndns;
  in
  {
    options = {
      services.cfdyndns = {
        enable = mkEnableOption "Cloudflare Dynamic DNS Client";
  
negative.code:         '';
        };
  
        apikeyFile = mkOption {
          default = null;
          type = types.nullOr types.str;
          description = ''
            The path to a file containing the API Key
            used to authenticate with CloudFlare.
          '';
        };
  
  