diff --git a/pkgs/default.nix b/pkgs/default.nix
index 75ecb28..1089295 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -91,6 +91,7 @@ in {
   odhcp-script = callPackage ./odhcp-script {};
   odhcp6c = callPackage ./odhcp6c {};
   openwrt = callPackage ./openwrt {};
+  output-template = callPackage ./output-template { };
   ppp = callPackage ./ppp {};
   pppoe = callPackage ./pppoe {};
   preinit = callPackage ./preinit {};
diff --git a/pkgs/output-template/Makefile b/pkgs/output-template/Makefile
new file mode 100644
index 0000000..1623f8a
--- /dev/null
+++ b/pkgs/output-template/Makefile
@@ -0,0 +1,3 @@
+check:
+	./output-template ./example-output/ '{{' '}}' < example.ini > output
+	diff -u output example.ini.expected
diff --git a/pkgs/output-template/default.nix b/pkgs/output-template/default.nix
new file mode 100644
index 0000000..19566e4
--- /dev/null
+++ b/pkgs/output-template/default.nix
@@ -0,0 +1,34 @@
+{
+  fetchurl,
+  writeFennel,
+  fennel,
+  runCommand,
+  lua,
+  anoia,
+  linotify,
+  lualinux,
+  stdenv
+}:
+let name = "output-template";
+in stdenv.mkDerivation {
+  inherit name;
+  src = ./.;
+
+  buildInputs = [lua];
+  doCheck = true;
+
+  buildPhase = ''
+    cp -p ${writeFennel name {
+      packages = [
+        anoia
+        lualinux
+        linotify
+      ] ;
+      mainFunction = "run";
+    } ./output-template.fnl } ${name}
+  '';
+  checkPhase = "make check";
+  installPhase = ''
+    install -D ${name} $out/bin/${name}
+  '';
+}
diff --git a/pkgs/output-template/example-output/addresses/1/attribute b/pkgs/output-template/example-output/addresses/1/attribute
new file mode 100644
index 0000000..b54f8c3
--- /dev/null
+++ b/pkgs/output-template/example-output/addresses/1/attribute
@@ -0,0 +1 @@
+a11
diff --git a/pkgs/output-template/example-output/addresses/3/attribute b/pkgs/output-template/example-output/addresses/3/attribute
new file mode 100644
index 0000000..711c1a1
--- /dev/null
+++ b/pkgs/output-template/example-output/addresses/3/attribute
@@ -0,0 +1 @@
+a33
diff --git a/pkgs/output-template/example-output/addresses/5/attribute b/pkgs/output-template/example-output/addresses/5/attribute
new file mode 100644
index 0000000..8092345
--- /dev/null
+++ b/pkgs/output-template/example-output/addresses/5/attribute
@@ -0,0 +1 @@
+a55
diff --git a/pkgs/output-template/example-output/addresses/6/attribute b/pkgs/output-template/example-output/addresses/6/attribute
new file mode 100644
index 0000000..9139598
--- /dev/null
+++ b/pkgs/output-template/example-output/addresses/6/attribute
@@ -0,0 +1 @@
+a66
diff --git a/pkgs/output-template/example-output/colours/black b/pkgs/output-template/example-output/colours/black
new file mode 100644
index 0000000..c4949eb
--- /dev/null
+++ b/pkgs/output-template/example-output/colours/black
@@ -0,0 +1 @@
+000000
diff --git a/pkgs/output-template/example-output/colours/blue b/pkgs/output-template/example-output/colours/blue
new file mode 100644
index 0000000..df785ee
--- /dev/null
+++ b/pkgs/output-template/example-output/colours/blue
@@ -0,0 +1 @@
+0000ff
diff --git a/pkgs/output-template/example-output/colours/green b/pkgs/output-template/example-output/colours/green
new file mode 100644
index 0000000..9f07fb6
--- /dev/null
+++ b/pkgs/output-template/example-output/colours/green
@@ -0,0 +1 @@
+00ff00
diff --git a/pkgs/output-template/example-output/colours/red b/pkgs/output-template/example-output/colours/red
new file mode 100644
index 0000000..db6f1d8
--- /dev/null
+++ b/pkgs/output-template/example-output/colours/red
@@ -0,0 +1 @@
+ff0000
diff --git a/pkgs/output-template/example-output/name b/pkgs/output-template/example-output/name
new file mode 100644
index 0000000..dbf1b39
--- /dev/null
+++ b/pkgs/output-template/example-output/name
@@ -0,0 +1 @@
+eth1
diff --git a/pkgs/output-template/example.ini b/pkgs/output-template/example.ini
new file mode 100644
index 0000000..4f4d3b9
--- /dev/null
+++ b/pkgs/output-template/example.ini
@@ -0,0 +1,2 @@
+wpa_passphrase={{ secret "colours/black"  }}
+think = {{ string.format("%q", secret("colours/blue")) }}
diff --git a/pkgs/output-template/example.ini.expected b/pkgs/output-template/example.ini.expected
new file mode 100644
index 0000000..47c6f93
--- /dev/null
+++ b/pkgs/output-template/example.ini.expected
@@ -0,0 +1,2 @@
+wpa_passphrase=000000
+think = "0000ff"
diff --git a/pkgs/output-template/output-template.fnl b/pkgs/output-template/output-template.fnl
new file mode 100644
index 0000000..a6365a7
--- /dev/null
+++ b/pkgs/output-template/output-template.fnl
@@ -0,0 +1,22 @@
+(local svc (require :anoia.svc))
+
+(fn substitute [text service opening closing]
+  (let [delim (.. opening "(.-)" closing)
+        myenv {
+               : string
+               :secret (fn [x] (service:output x))
+               :lua_quote #(string.format "%q" %1)
+               }]
+    (string.gsub text delim
+                 (fn [x]
+                   (assert ((load (.. "return " x) x :t myenv))
+                           (string.format "missing value for %q" x))))))
+
+(fn run []
+  (let [[service-dir opening closing] arg
+        service (assert (svc.open service-dir))
+        out  (substitute (: (io.input) :read "*a") service opening closing)]
+    (io.write out)))
+
+
+{ : run }