anchor.diff:        description = ''
           The name that will be given to this DNSCrypt resolver.
           Note: the resolver name must start with <literal>2.dnscrypt-cert.</literal>.
  +      '';
  +    };
  +
  +    providerKey.public = mkOption {
  +      type = types.nullOr types.path;
  +      default = null;
  +      example = "/etc/secrets/public.key";
  +      description = ''
  +        The filepath to the provider public key. If not given a new
  +        provider key pair will be generated on the first run.
  +      '';
  +    };
  +
  +    providerKey.secret = mkOption {
  +      type = types.nullOr types.path;
  +      default = null;
  +      example = "/etc/secrets/secret.key";
  +      description = ''
  +        The filepath to the provider secret key. If not given a new
  +        provider key pair will be generated on the first run.
         '';
       };
   
  
positive.code: let
    cfg     = config.services.dnscrypt-wrapper;
    dataDir = "/var/lib/dnscrypt-wrapper";
  
    daemonArgs = with cfg; [
      "--listen-address=${address}:${toString port}"
      "--resolver-address=${upstream.address}:${toString upstream.port}"
      "--provider-name=${providerName}"
      "--provider-publickey-file=public.key"
      "--provider-secretkey-file=secret.key"
      "--provider-cert-file=${providerName}.crt"
      "--crypt-secretkey-file=${providerName}.key"
    ];
  
negative.code:       dnscrypt-wrapper --gen-cert-file \
          --crypt-secretkey-file=${cfg.providerName}.key \
          --provider-cert-file=${cfg.providerName}.crt \
          --provider-publickey-file=${publicKey} \
          --provider-secretkey-file=${secretKey} \
          --cert-file-expire-days=${toString cfg.keys.expiration}
      }
  
      cd ${dataDir}
  
      # generate provider keypair (first run only)
      ${optionalString (cfg.providerKey.public == null || cfg.providerKey.secret == null) ''
        if [ ! -f ${publicKey} ] || [ ! -f ${secretKey} ]; then
          dnscrypt-wrapper --gen-provider-keypair
        fi
      ''}
  
      # generate new keys for rotation
      if [ ! -f ${cfg.providerName}.key ] || [ ! -f ${cfg.providerName}.crt ]; then
  