anchor.diff:            ";
           };
   
  +        bind = {
  +          distinguishedName = mkOption {
  +            default = "";
  +            example = "cn=admin,dc=example,dc=com";
  +            type = with pkgs.lib.types; string;
  +            description = "
  +              The distinguished name to bind to the LDAP server with. If this
  +              is not specified, an anonymous bind will be done.
  +            ";
  +          };
  +
  +          password = mkOption {
  +            default = "/etc/ldap/bind.password";
  +            type = with pkgs.lib.types; string;
  +            description = "
  +              The path to a file containing the credentials to use when binding
  +              to the LDAP server (if not binding anonymously).
  +            ";
  +          };
  +        };
  +
         };
       };
     };
  
positive.code:             uri ${config.users.ldap.server}
              base ${config.users.ldap.base}
  
              ${if config.users.ldap.useTLS then ''
                ssl start_tls
                tls_checkpeer no
              '' else ""}
            '';
          target = "ldap.conf";
        }
  
negative.code:     ];
    };
  
    system.activationScripts.ldap = stringAfter [ "etc" ] (
      optionalString (config.users.ldap.bind.distinguishedName != "") ''
        if test -f "${config.users.ldap.bind.password}" ; then
          echo "bindpw $(cat ${config.users.ldap.bind.password})" | cat /etc/ldap.conf - > /etc/ldap.conf.bindpw
          mv -fT /etc/ldap.conf.bindpw /etc/ldap.conf
          chmod 600 /etc/ldap.conf
        fi
      ''
    );
  
  }
  