anchor.diff:        script = ''
           ${findutils}/bin/find /run/secrets -type f | ${gnugrep}/bin/grep -vf ${
             writeText "secret-paths" (
  -            concatMapStringsSep "\n" (s: s.svc.path) allSecretSvcs
  +            concatStringsSep "\n" (concatMap (svcName:
  +              map ({svc,...}: svc.path) (secretsForService svcName)
  +            ) svcNames)
             )
           } | ${findutils}/bin/xargs -r rm -v
         '';
  
positive.code:     };
    };
  
    allSecretSvcs = flatten (mapAttrsToList (secretName: secret:
      mapAttrsToList
        (svcName: svc: { inherit secretName secret svcName svc; })
        secret.services
    ) config.crypto.secrets);
  
    dependentServices = genAttrs (unique (map (s: s.svcName) allSecretSvcs)) (svcName: {
      restartTriggers = singleton (hashString "sha256" (concatMapStrings (
        {secret, svc, ...}: decryptSecretScript secret svc
      ) (filter (s: s.svcName == svcName) allSecretSvcs)));
    });
  
    decryptServices = mapAttrsToList (secretName: secret: {
      "secret-${secretName}" = rec {
        wantedBy = map (s: s+".service") (attrNames secret.services);
        before = wantedBy;
        script = concatMapStringsSep "\n"
                   (svc: decryptSecretScript secret svc)
                   (attrValues secret.services);
        serviceConfig = {
          Type = "oneshot";
          RemainAfterExit = true;
        };
      };
    }) config.crypto.secrets;
  
    purgeOldSecrets = singleton {
      purge-old-secrets = {
  
negative.code: 
    config = mkIf (config.crypto.secrets != {}) {
      systemd.services = mkMerge (
        dependentServices ++ decryptServices ++ purgeOldSecrets
      );
    };
  
  