anchor.diff:            pkgs.writeText "prometheus.yml" cfg.configText
           else generatedPrometheusYml;
       in
  -    promtoolCheck "check config" "prometheus.yml" yml;
  +    promtoolCheck "check config ${lib.optionalString (cfg.checkConfig == "syntax-only") "--syntax-only"}" "prometheus.yml" yml;
   
     cmdlineArgs = cfg.extraFlags ++ [
       "--storage.tsdb.path=${workingDir}/data/"
  
positive.code: let
    json = pkgs.formats.json { };
    cfg = config.services.prometheus;
  
    workingDir = "/var/lib/" + cfg.stateDir;
  
  
negative.code:     };
  
      checkConfig = mkOption {
        type = with types; either bool (enum [ "syntax-only" ]);
        default = true;
        example = "syntax-only";
        description = ''
          Check configuration with <literal>promtool
          check</literal>. The call to <literal>promtool</literal> is
          subject to sandboxing by Nix.
  
          If you use credentials stored in external files
          (<literal>password_file</literal>, <literal>bearer_token_file</literal>, etc),
          they will not be visible to <literal>promtool</literal>
          and it will report errors, despite a correct configuration.
          To resolve this, you may set this option to <literal>"syntax-only"</literal>
          in order to only syntax check the Prometheus configuration.
        '';
      };
  
  