anchor.diff:  
     # a wrapper that verifies that the configuration is valid
     promtoolCheck = what: name: file:
  -    if cfg.checkConfig then
  +    if checkConfigEnabled then
         pkgs.runCommandLocal
           "${name}-${replaceStrings [" "] [""] what}-checked"
           { buildInputs = [ cfg.package ]; } ''
  
positive.code:     };
  
      checkConfig = mkOption {
        type = types.bool;
        default = true;
        description = ''
          Check configuration with <literal>promtool
          check</literal>. The call to <literal>promtool</literal> is
          subject to sandboxing by Nix. When credentials are stored in
          external files (<literal>password_file</literal>,
          <literal>bearer_token_file</literal>, etc), they will not be
          visible to <literal>promtool</literal> and it will report
          errors, despite a correct configuration.
        '';
      };
  
  
negative.code: let
    json = pkgs.formats.json { };
    cfg = config.services.prometheus;
    checkConfigEnabled =
      (lib.isBool cfg.checkConfig && cfg.checkConfig)
        || cfg.checkConfig == "syntax-only";
  
    workingDir = "/var/lib/" + cfg.stateDir;
  
  