anchor.diff:              dataDir = lib.escapeShellArg (getAttr dn dataDirs);
             in ''
               rm -rf ${dataDir}/*
  -            ${openldap}/bin/slapadd -F ${configDir} -b ${dn} -l ${file}
  +            ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -b ${dn} -l ${file}
               chown -R "${cfg.user}:${cfg.group}" ${dataDir}
             '') dataFiles)}
           '')}
   
  -        ${openldap}/bin/slaptest -u -F ${configDir}
  +        ${openldap}/bin/slaptest -u -F ${lib.escapeShellArg configDir}
         '';
         serviceConfig = {
  -        ExecStart = lib.concatStringsSep " " [
  -          "${openldap}/libexec/slapd"
  -          "-u '${cfg.user}'"
  -          "-g '${cfg.group}'"
  -          "-h '${concatStringsSep " " cfg.urlList}'"
  -          "-F ${configDir}"
  -        ];
  +        ExecStart = lib.escapeShellArgs ([
  +          "${openldap}/libexec/slapd" "-u" cfg.user "-g" cfg.group "-F" configDir
  +          "-h" (lib.concatStringsSep " " cfg.urlList)
  +        ]);
           Type = "forking";
           PIDFile = cfg.settings.attrs.olcPidFile;
         };
       };
   
       users.users = lib.optionalAttrs (cfg.user == "openldap") {
  -      openldap = { group = cfg.group; };
  +      openldap = {
  +        group = cfg.group;
  +        isSystemUser = true;
  +      };
       };
   
       users.groups = lib.optionalAttrs (cfg.group == "openldap") {
  
positive.code:       };
  
        logLevel = mkOption {
          type = types.nullOr (types.listOf types.str);
          default = null;
          example = literalExample "[ \"acl\" \"trace\" ]";
          description = "The log level.";
  
negative.code:         mkdir -p /run/slapd
          chown -R "${cfg.user}:${cfg.group}" /run/slapd
  
          mkdir -p ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
          chown "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
  
          ${lib.optionalString (cfg.configDir == null) (
            if (cfg.extraConfig != "" || cfg.extraDatabaseConfig != "") then ''
  