anchor.diff:      (if cfg.configText != null then cfg.configText else
       ''
         [ global ]
  -      log file = ${logDir}/log.%m
  -      private dir = ${privateDir}
  -      ${optionalString cfg.syncPasswordsByPam "pam password change = true"}
  +      security = ${cfg.securityType}
  +      passwd program = /var/setuid-wrappers/passwd %u
  +      pam password change = ${toString cfg.syncPasswordsByPam}
  +      invalid users = ${toString cfg.invalidUsers}
   
         ${cfg.extraConfig}
   
  
positive.code:     services.samba = {
  
        enable = mkOption {
          default = false;
          description = "
            Whether to enable Samba, which provides file and print
            services to Windows clients through the SMB/CIFS protocol.
          ";
        };
  
        package = mkOption {
          default = pkgs.samba;
          example = pkgs.samba4;
          description = ''
  
negative.code:       };
  
        syncPasswordsByPam = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Enabling this will add a line directly after pam_unix.so.
            Whenever a password is changed the samba password will be updated as well.
            However you still yave to add the samba password once using smbpasswd -a user
            If you don't want to maintain an extra pwd database you still can send plain text
            passwords which is not secure.
          '';
        };
  
        invalidUsers = mkOption {
          type = types.listOf types.str;
          default = [ "root" ];
          description = ''
            List of users who are denied to login via Samba.
          '';
        };
  
        extraConfig = mkOption {
          type = types.lines;
          default = "";
          description = ''
            Additional global section and extra section lines go in here.
          '';
        };
  
        configText = mkOption {
          type = types.nullOr types.lines;
          default = null;
          description = ''
            Verbatim contents of smb.conf. If null (default), use the
            autogenerated file from NixOS instead.
          '';
        };
  
        securityType = mkOption {
          type = types.str;
          default = "user";
          example = "share";
          description = "Samba security type";
        };
  
        nsswins = mkOption {
  