anchor.diff:        };
       };
   
  -    auth.anonymous = {
  -      enable = mkOption {
  -        description = "Whether to allow anonymous access.";
  -        default = false;
  -        type = types.bool;
  -      };
  -      org_name = mkOption {
  -        description = "Which organization to allow anonymous access to.";
  -        default = "Main Org.";
  -        type = types.str;
  -      };
  -      org_role = mkOption {
  -        description = "Which role anonymous users have in the organization.";
  -        default = "Viewer";
  -        type = types.str;
  -      };
  -
  +    auth = {
  +      anonymous = {
  +        enable = mkOption {
  +          description = "Whether to allow anonymous access.";
  +          default = false;
  +          type = types.bool;
  +        };
  +        org_name = mkOption {
  +          description = "Which organization to allow anonymous access to.";
  +          default = "Main Org.";
  +          type = types.str;
  +        };
  +        org_role = mkOption {
  +          description = "Which role anonymous users have in the organization.";
  +          default = "Viewer";
  +          type = types.str;
  +        };
  +      };
  +      google = {
  +        enable = mkOption {
  +          description = "Whether to allow Google OAuth2.";
  +          default = false;
  +          type = types.bool;
  +        };
  +        allowSignUp = mkOption {
  +          description = "Whether to allow sign up with Google OAuth2.";
  +          default = false;
  +          type = types.bool;
  +        };
  +        clientId = mkOption {
  +          description = "Google OAuth2 client ID.";
  +          default = "";
  +          type = types.str;
  +        };
  +        clientSecretFile = mkOption {
  +          description = "Google OAuth2 client secret.";
  +          default = null;
  +          type = types.nullOr types.path;
  +        };
  +      };
       };
   
       analytics.reporting = {
  
positive.code:         QT_QPA_PLATFORM = "offscreen";
        } // mapAttrs' (n: v: nameValuePair "GF_${n}" (toString v)) envOptions;
        script = ''
          ${optionalString (cfg.database.passwordFile != null) ''
            export GF_DATABASE_PASSWORD="$(cat ${escapeShellArg cfg.database.passwordFile})"
          ''}
  
negative.code:     AUTH_ANONYMOUS_ENABLED = boolToString cfg.auth.anonymous.enable;
      AUTH_ANONYMOUS_ORG_NAME = cfg.auth.anonymous.org_name;
      AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
      AUTH_GOOGLE_ENABLED = boolToString cfg.auth.google.enable;
      AUTH_GOOGLE_ALLOW_SIGN_UP = boolToString cfg.auth.google.allowSignUp;
      AUTH_GOOGLE_CLIENT_ID = cfg.auth.google.clientId;
  
      ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
  
  