anchor.diff:          Type = "forking";
           PIDFile = pidFile;
           KillMode = "process";
  +        RuntimeDirectory = "keepalived";
  +        EnvironmentFile = lib.optional (cfg.secretFile != null) cfg.secretFile;
  +        ExecStartPre = lib.optional (cfg.secretFile != null)
  +        (pkgs.writeShellScript "keepalived-pre-start" ''
  +          umask 077
  +          ${pkgs.envsubst}/bin/envsubst -i "${keepalivedConf}" > ${finalConfigFile}
  +        '');
           ExecStart = "${pkgs.keepalived}/sbin/keepalived"
  -          + " -f ${keepalivedConf}"
  +          + " -f ${finalConfigFile}"
             + " -p ${pidFile}"
             + optionalString cfg.snmp.enable " --snmp";
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
  
positive.code:       };
      };
  
      systemd.services.keepalived = {
        description = "Keepalive Daemon (LVS and VRRP)";
        after = [ "network.target" "network-online.target" "syslog.target" ];
        wants = [ "network-online.target" ];
  
negative.code:         '';
        };
  
        secretFile = mkOption {
          type = types.nullOr types.path;
          default = null;
          example = "/run/keys/keepalived.env";
          description = ''
            Environment variables from this file will be interpolated into the
            final config file using envsubst with this syntax: <literal>$ENVIRONMENT</literal>
            or <literal>''${VARIABLE}</literal>.
            The file should contain lines formatted as <literal>SECRET_VAR=SECRET_VALUE</literal>.
            This is useful to avoid putting secrets into the nix store.
          '';
        };
  
      };
    };
  
  