anchor.diff:          ssl_cert = <${cfg.sslServerCert}
           ssl_key = <${cfg.sslServerKey}
           ${optionalString (cfg.sslCACert != null) ("ssl_ca = <" + cfg.sslCACert)}
  -        ssl_dh = <${config.security.dhparams.params.dovecot2.path}
  +        ${optionalString cfg.enableDHE ''ssl_dh = <${config.security.dhparams.params.dovecot2.path}''}
           disable_plaintext_auth = yes
         ''
       )
  
positive.code:       description = "Whether to create a own Dovecot PAM service and configure PAM user logins.";
      };
  
      sieveScripts = mkOption {
        type = types.attrsOf types.path;
        default = {};
  
negative.code:   config = mkIf cfg.enable {
      security.pam.services.dovecot2 = mkIf cfg.enablePAM {};
  
      security.dhparams = mkIf (cfg.sslServerCert != null && cfg.enableDHE) {
        enable = true;
        params.dovecot2 = {};
      };
  