anchor.diff:  
       users.users = {
         dovenull =
  -        { uid = config.ids.uids.dovenull2;
  +        {
  +          uid = config.ids.uids.dovenull2;
             description = "Dovecot user for untrusted logins";
             group = "dovenull";
           };
       } // optionalAttrs (cfg.user == "dovecot2") {
         dovecot2 =
  -         { uid = config.ids.uids.dovecot2;
  -           description = "Dovecot user";
  -           group = cfg.group;
  -         };
  +        {
  +          uid = config.ids.uids.dovecot2;
  +          description = "Dovecot user";
  +          group = cfg.group;
  +        };
       } // optionalAttrs (cfg.createMailUser && cfg.mailUser != null) {
         ${cfg.mailUser} =
  -        { description = "Virtual Mail User"; } //
  -        optionalAttrs (cfg.mailGroup != null)
  +        { description = "Virtual Mail User"; } // optionalAttrs (cfg.mailGroup != null)
             { group = cfg.mailGroup; };
       };
   
  
positive.code:     };
  
      mailPlugins =
      let plugins = hint: types.submodule {
          options = {
            enable = mkOption {
              type = types.listOf types.str;
              default = [];
              description = "mail plugins to enable as a list of strings to append to the ${hint} <literal>$mail_plugins</literal> configuration variable";
            };
          };
        };
      in
      mkOption {
        type = with types; submodule {
          options = {
            globally = mkOption {
              type = plugins "top-level";
              example = { enable = [ "virtual" ]; };
              default = { enable = []; };
            };
            perProtocol = mkOption {
              type = attrsOf (plugins "corresponding per-protocol");
              default = {};
              example = { imap = [ "imap_acl" ]; };
            };
          };
        };
        description = "Additional entries to add to the mail_plugins variable, globally and per protocol";
        example = {
          globally.enable = [ "acl" ];
          perProtocol.imap.enable = [ "imap_acl" ];
        };
        default = { globally.enable = []; perProtocol = {};};
      };
  
      configFile = mkOption {
        type = types.nullOr types.path;
  
negative.code:       }
      ''
  
      (
        optionalString cfg.enablePAM ''
          userdb {
            driver = passwd
          }
  
          passdb {
            driver = pam
            args = ${optionalString cfg.showPAMFailure "failure_show_msg=yes"} dovecot2
          }
        ''
      )
  
      (
        optionalString (cfg.sieveScripts != {}) ''
          plugin {
            ${concatStringsSep "\n" (mapAttrsToList (to: from: "sieve_${to} = ${stateDir}/sieve/${to}") cfg.sieveScripts)}
          }
        ''
      )
  
      (
        optionalString (cfg.mailboxes != []) ''
          protocol imap {
            namespace inbox {
              inbox=yes
              ${concatStringsSep "\n" (map mailboxConfig cfg.mailboxes)}
            }
          }
        ''
      )
  
      (
        optionalString cfg.enableQuota ''
          service quota-status {
            executable = ${dovecotPkg}/libexec/dovecot/quota-status -p postfix
            inet_listener {
              port = ${cfg.quotaPort}
            }
            client_limit = 1
          }
  
          plugin {
            quota_rule = *:storage=${cfg.quotaGlobalPerUser}
            quota = maildir:User quota # per virtual mail user quota # BUG/FIXME broken, we couldn't get this working
            quota_status_success = DUNNO
            quota_status_nouser = DUNNO
            quota_status_overquota = "552 5.2.2 Mailbox is full"
            quota_grace = 10%%
          }
        ''
      )
  
      cfg.extraConfig
    ];
  