anchor.diff:              ${openldap}/bin/slapadd -F ${configDir} -bcn=config -l ${settingsFile}
             ''
           )}
  -        chown -R "${cfg.user}:${cfg.group}" ${configDir}
  +        chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir}
   
           ${if types.lines.check cfg.declarativeContents then (let
             dataFile = pkgs.writeText "ldap-contents.ldif" cfg.declarativeContents;
           in ''
             rm -rf ${lib.escapeShellArg cfg.dataDir}/*
  -          ${openldap}/bin/slapadd -F ${configDir} -l ${dataFile}
  +          ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -l ${dataFile}
             chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg cfg.dataDir}
           '') else (let
             dataFiles = lib.mapAttrs (dn: contents: pkgs.writeText "${dn}.ldif" contents) cfg.declarativeContents;
  
positive.code:     ${if cfg.extraDatabaseConfig != null then cfg.extraDatabaseConfig else ""}
    '');
  
    configDir = lib.escapeShellArg (if cfg.configDir != null then cfg.configDir else "/etc/openldap/slapd.d");
  
    ldapValueType = let
      singleLdapValueType = types.either types.str (types.submodule {
  
negative.code:         mkdir -p /run/slapd
          chown -R "${cfg.user}:${cfg.group}" /run/slapd
  
          mkdir -p ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
          chown "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
  
          ${lib.optionalString (cfg.configDir == null) (
            if (cfg.extraConfig != "" || cfg.extraDatabaseConfig != "") then ''
  