anchor.diff:      systemd.services.prometheus = {
         wantedBy = [ "multi-user.target" ];
         after    = [ "network.target" ];
  +      preStart = ''
  +         ${lib.getBin pkgs.envsubst}/bin/envsubst -o "/run/prometheus/prometheus-substituted.yaml" \
  +                                                  -i "${prometheusYml}"
  +      '';
         serviceConfig = {
           ExecStart = "${cfg.package}/bin/prometheus" +
             optionalString (length cmdlineArgs != 0) (" \\\n  " +
               concatStringsSep " \\\n  " cmdlineArgs);
           User = "prometheus";
           Restart  = "always";
  +        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
  +        RuntimeDirectory = "prometheus";
  +        RuntimeDirectoryMode = "0700";
           WorkingDirectory = workingDir;
           StateDirectory = cfg.stateDir;
         };
  
positive.code:       '';
      };
  
      configText = mkOption {
        type = types.nullOr types.lines;
        default = null;
  
negative.code: 
    cmdlineArgs = cfg.extraFlags ++ [
      "--storage.tsdb.path=${workingDir}/data/"
      "--config.file=/run/prometheus/prometheus-substituted.yaml"
      "--web.listen-address=${cfg.listenAddress}:${builtins.toString cfg.port}"
      "--alertmanager.notification-queue-capacity=${toString cfg.alertmanagerNotificationQueueCapacity}"
      "--alertmanager.timeout=${toString cfg.alertmanagerTimeout}s"
  