anchor.diff:          set -o errexit -o pipefail -o nounset -o errtrace
           shopt -s inherit_errexit
   
  +        ${optionalString (cfg.auth.azuread.clientSecretFile != null) ''
  +          GF_AUTH_AZUREAD_CLIENT_SECRET="$(<${escapeShellArg cfg.auth.azuread.clientSecretFile})"
  +          export GF_AUTH_AZUREAD_CLIENT_SECRET
  +        ''}
           ${optionalString (cfg.auth.google.clientSecretFile != null) ''
             GF_AUTH_GOOGLE_CLIENT_SECRET="$(<${escapeShellArg cfg.auth.google.clientSecretFile})"
             export GF_AUTH_GOOGLE_CLIENT_SECRET
  
positive.code:     AUTH_ANONYMOUS_ENABLED = boolToString cfg.auth.anonymous.enable;
      AUTH_ANONYMOUS_ORG_NAME = cfg.auth.anonymous.org_name;
      AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
      AUTH_GOOGLE_ENABLED = boolToString cfg.auth.google.enable;
      AUTH_GOOGLE_ALLOW_SIGN_UP = boolToString cfg.auth.google.allowSignUp;
      AUTH_GOOGLE_CLIENT_ID = cfg.auth.google.clientId;
  
negative.code:         org_role = mkOption {
            description = "Which role anonymous users have in the organization.";
            default = "Viewer";
            type = types.str;
          };
        };
        azuread = {
          enable = mkOption {
            description = "Whether to allow Azure AD OAuth.";
            default = false;
            type = types.bool;
          };
          allowSignUp = mkOption {
            description = "Whether to allow sign up with Azure AD OAuth.";
            default = false;
            type = types.bool;
          };
          clientId = mkOption {
            description = "Azure AD OAuth client ID.";
            default = "";
            type = types.str;
          };
          clientSecretFile = mkOption {
            description = "Azure AD OAuth client secret.";
            default = null;
            type = types.nullOr types.path;
          };
          tenantId = mkOption {
            description = ''
              Tenant id used to create auth and token url. Default to "common"
              , let user sign in with any tenant.
              '';
            default = "common";
            type = types.str;
          };
          allowedDomains = mkOption {
            description = ''
              To limit access to authenticated users who are members of one or more groups,
              set allowedGroups to a comma- or space-separated list of group object IDs.
              You can find object IDs for a specific group on the Azure portal.
            '';
            default = "";
            type = types.str;
          };
          allowedGroups = mkOption {
            description = ''
              Limits access to users who belong to specific domains.
              Separate domains with space or comma.
            '';
            default = "";
            type = types.str;
          };
        };
  