anchor.diff:           else findPkiDefinitions newPath val;
       in flatten (mapAttrsToList mkSublist attrs);
     in all isNull (findPkiDefinitions [] manualPkiOptions);
  -
  -  configFile = pkgs.writeText "taskdrc" (''
  -    # systemd related
  -    daemon = false
  -    log = -
  -
  -    # logging
  -    ${mkConfLine "debug" cfg.debug}
  -    ${mkConfLine "ip.log" cfg.ipLog}
  -
  -    # general
  -    ${mkConfLine "ciphers" cfg.ciphers}
  -    ${mkConfLine "confirmation" cfg.confirmation}
  -    ${mkConfLine "extensions" cfg.extensions}
  -    ${mkConfLine "queue.size" cfg.queueSize}
  -    ${mkConfLine "request.limit" cfg.requestLimit}
  -
  -    # client
  -    ${mkConfLine "client.allow" cfg.allowedClientIDs}
  -    ${mkConfLine "client.deny" cfg.disallowedClientIDs}
  -
  -    # server
  -    server = ${cfg.listenHost}:${toString cfg.listenPort}
  -    ${mkConfLine "trust" cfg.trust}
  -
  -    # PKI options
  -    ${if needToCreateCA then ''
  -      ca.cert = ${cfg.dataDir}/keys/ca.cert
  -      server.cert = ${cfg.dataDir}/keys/server.cert
  -      server.key = ${cfg.dataDir}/keys/server.key
  -      server.crl = ${cfg.dataDir}/keys/server.crl
  -    '' else ''
  -      ca.cert = ${cfg.pki.manual.ca.cert}
  -      server.cert = ${cfg.pki.manual.server.cert}
  -      server.key = ${cfg.pki.manual.server.key}
  -      server.crl = ${cfg.pki.manual.server.crl}
  -    ''}
  -  '' + cfg.extraConfig);
   
     orgOptions = { name, ... }: {
       options.users = mkOption {
  
positive.code:       pki.manual = manualPkiOptions;
        pki.auto = autoPkiOptions;
  
        extraConfig = mkOption {
          type = types.lines;
          default = "";
          example = "client.cert = /tmp/debugging.cert";
          description = ''
            Extra lines to append to the taskdrc configuration file.
          '';
        };
      };
    };
  
    config = mkMerge [
      (mkIf cfg.enable {
  
negative.code:         gid = config.ids.gids.taskd;
        };
  
        services.taskserver.config = {
          # systemd related
          daemon = false;
          log = "-";
  
          # logging
          debug = cfg.debug;
          ip.log = cfg.ipLog;
  
          # general
          ciphers = cfg.ciphers;
          confirmation = cfg.confirmation;
          extensions = cfg.extensions;
          queue.size = cfg.queueSize;
          request.limit = cfg.requestLimit;
  
          # client
          client.allow = cfg.allowedClientIDs;
          client.deny = cfg.disallowedClientIDs;
  
          # server
          trust = cfg.trust;
          server = {
            listen = "${cfg.listenHost}:${toString cfg.listenPort}";
          } // (if needToCreateCA then {
            cert = "${cfg.dataDir}/keys/server.cert";
            key = "${cfg.dataDir}/keys/server.key";
            crl = "${cfg.dataDir}/keys/server.crl";
          } else {
            cert = "${cfg.pki.manual.server.cert}";
            key = "${cfg.pki.manual.server.key}";
            crl = "${cfg.pki.manual.server.crl}";
          });
  
          ca.cert = if needToCreateCA then "${cfg.dataDir}/keys/ca.cert"
                    else "${cfg.pki.manual.ca.cert}";
        };
  
        systemd.services.taskserver-init = {
          wantedBy = [ "taskserver.service" ];
          before = [ "taskserver.service" ];
  