anchor.diff:        (flip mapAttrs cfg.ldap-proxy.settings
           (const (mapAttrs (const renderValue)))));
   
  +  privacyidea-token-janitor = pkgs.writeShellScriptBin "privacyidea-token-janitor" ''
  +    exec -a privacyidea-token-janitor \
  +      /run/wrappers/bin/sudo -u ${cfg.user} \
  +      env PRIVACYIDEA_CONFIGFILE=${cfg.stateDir}/privacyidea.cfg \
  +      ${penv}/bin/privacyidea-token-janitor $@
  +  '';
   in
   
   {
  
positive.code:         description = lib.mdDoc "Group account under which PrivacyIDEA runs.";
        };
  
        ldap-proxy = {
          enable = mkEnableOption (lib.mdDoc "PrivacyIDEA LDAP Proxy");
  
  
negative.code: 
      (mkIf cfg.enable {
  
        assertions = [
          {
            assertion = cfg.tokenjanitor.enable -> (cfg.tokenjanitor.orphaned || cfg.tokenjanitor.unassigned);
            message = ''
              privacyidea-token-janitor has no effect if neither orphaned nor unassigned tokens
              are to be searched.
            '';
          }
        ];
  
        environment.systemPackages = [ pkgs.privacyidea (hiPrio privacyidea-token-janitor) ];
  
        services.postgresql.enable = mkDefault true;
  
        systemd.services.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
          environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
          path = [ penv ];
          serviceConfig = {
            CapabilityBoundingSet = [ "" ];
            ExecStart = "${pkgs.writeShellScript "pi-token-janitor" ''
              ${optionalString cfg.tokenjanitor.orphaned ''
                echo >&2 "Removing orphaned tokens..."
                privacyidea-token-janitor find \
                  --orphaned true \
                  --action ${cfg.tokenjanitor.action}
              ''}
              ${optionalString cfg.tokenjanitor.unassigned ''
                echo >&2 "Removing unassigned tokens..."
                privacyidea-token-janitor find \
                  --assigned false \
                  --action ${cfg.tokenjanitor.action}
              ''}
            ''}";
            Group = cfg.group;
            LockPersonality = true;
            MemoryDenyWriteExecute = true;
            ProtectHome = true;
            ProtectHostname = true;
            ProtectKernelLogs = true;
            ProtectKernelModules = true;
            ProtectKernelTunables = true;
            ProtectSystem = "strict";
            ReadWritePaths = cfg.stateDir;
            Type = "oneshot";
            User = cfg.user;
            WorkingDirectory = cfg.stateDir;
          };
        };
        systemd.timers.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
          wantedBy = [ "timers.target" ];
          timerConfig.OnCalendar = cfg.tokenjanitor.interval;
          timerConfig.Persistent = true;
        };
  
        systemd.services.privacyidea = let
          piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
  