anchor.diff:                ${optionalString cfg.enableKwallet
                   ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                    " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
  +              ${optionalString cfg.enableGnomeKeyring
  +                ("auth optional ${pkgs.gnome3.gnome_keyring}/lib/security/pam_gnome_keyring.so")}
               '') + ''
             ${optionalString cfg.unixAuth
                 "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}
  
positive.code:           ${optionalString (cfg.enableKwallet)
                ("session optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                 " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
            ${optionalString (config.virtualisation.lxc.lxcfs.enable)
                 "session optional ${pkgs.lxcfs}/lib/security/pam_cgfs.so -c freezer,memory,name=systemd,unified,cpuset"}
          '');
  
negative.code:           user's default KDE wallet upon login. If the user has no wallet named
            "kdewallet", or the login password does not match their wallet
            password, KDE will prompt separately after login.
          '';
        };
  
        enableGnomeKeyring = mkOption {
          default = false;
          type = types.bool;
          description = ''
            If enabled, pam_gnome_keyring will attempt to automatically unlock the
            user's default Gnome keyring upon login. If the user login password does
            not match their keyring password, Gnome Keyring will prompt separately
            after login.
          '';
        };
  
  