anchor.diff:          type = types.lines;
           default = "";
           description = "Extra text appended to <filename>vault.hcl</filename>.";
  +      };
  +
  +      extraConfigPaths = mkOption {
  +        type = types.listOf types.path;
  +        default = [];
  +        description = ''
  +          Configuration files to load besides the immutable one defined by the NixOS module.
  +          This can be used to avoid putting credentials in the Nix store, which can be read by any user.
  +
  +          Each path can point to a JSON- or HCL-formatted file, or a directory
  +          to be scanned for files with <literal>.hcl</literal> or
  +          <literal>.json</literal> extensions.
  +
  +          To upload the confidential file with NixOps, use for example:
  +
  +          <programlisting><![CDATA[
  +          # https://releases.nixos.org/nixops/latest/manual/manual.html#opt-deployment.keys
  +          deployment.keys."vault.hcl" = let db = import ./db-credentials.nix; in {
  +            text = ${"''"}
  +              storage "postgresql" {
  +                connection_url = "postgres://''${db.username}:''${db.password}@host.example.com/exampledb?sslmode=verify-ca"
  +              }
  +            ${"''"};
  +            user = "vault";
  +          };
  +          services.vault.extraConfigPaths = ["/run/keys/vault.hcl"];
  +          services.vault.storageBackend = "postgresql";
  +          users.users.vault.extraGroups = ["keys"];
  +          ]]></programlisting>
  +        '';
         };
       };
     };
  
positive.code:       serviceConfig = {
          User = "vault";
          Group = "vault";
          ExecStart = "${cfg.package}/bin/vault server -config ${configFile}";
          ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
          PrivateDevices = true;
          PrivateTmp = true;
  
negative.code:       storageConfig = mkOption {
          type = types.nullOr types.lines;
          default = null;
          description = ''
            HCL configuration to insert in the storageBackend section.
  
            Confidential values should not be specified here because this option's
            value is written to the Nix store, which is publicly readable.
            Provide credentials and such in a separate file using
            <xref linkend="opt-services.vault.extraConfigPaths"/>.
          '';
        };
  
        telemetryConfig = mkOption {
  