anchor.diff:  
       (mkIf cfg.enable {
   
  -      environment.systemPackages = [ pkgs.privacyidea ];
  +      assertions = [
  +        {
  +          assertion = cfg.tokenjanitor.enable -> (cfg.tokenjanitor.orphaned || cfg.tokenjanitor.unassigned);
  +          message = ''
  +            privacyidea-token-janitor has no effect if neither orphaned nor unassigned tokens
  +            are to be searched.
  +          '';
  +        }
  +      ];
  +
  +      environment.systemPackages = [ pkgs.privacyidea (hiPrio privacyidea-token-janitor) ];
   
         services.postgresql.enable = mkDefault true;
  +
  +      systemd.services.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
  +        environment.PRIVACYIDEA_CONFIGFILE = "${cfg.stateDir}/privacyidea.cfg";
  +        path = [ penv ];
  +        serviceConfig = {
  +          CapabilityBoundingSet = [ "" ];
  +          ExecStart = "${pkgs.writeShellScript "pi-token-janitor" ''
  +            ${optionalString cfg.tokenjanitor.orphaned ''
  +              echo >&2 "Removing orphaned tokens..."
  +              privacyidea-token-janitor find \
  +                --orphaned true \
  +                --action ${cfg.tokenjanitor.action}
  +            ''}
  +            ${optionalString cfg.tokenjanitor.unassigned ''
  +              echo >&2 "Removing unassigned tokens..."
  +              privacyidea-token-janitor find \
  +                --assigned false \
  +                --action ${cfg.tokenjanitor.action}
  +            ''}
  +          ''}";
  +          Group = cfg.group;
  +          LockPersonality = true;
  +          MemoryDenyWriteExecute = true;
  +          ProtectHome = true;
  +          ProtectHostname = true;
  +          ProtectKernelLogs = true;
  +          ProtectKernelModules = true;
  +          ProtectKernelTunables = true;
  +          ProtectSystem = "strict";
  +          ReadWritePaths = cfg.stateDir;
  +          Type = "oneshot";
  +          User = cfg.user;
  +          WorkingDirectory = cfg.stateDir;
  +        };
  +      };
  +      systemd.timers.privacyidea-tokenjanitor = mkIf cfg.tokenjanitor.enable {
  +        wantedBy = [ "timers.target" ];
  +        timerConfig.OnCalendar = cfg.tokenjanitor.interval;
  +        timerConfig.Persistent = true;
  +      };
   
         systemd.services.privacyidea = let
           piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
  
positive.code:         description = lib.mdDoc "Group account under which PrivacyIDEA runs.";
        };
  
        ldap-proxy = {
          enable = mkEnableOption (lib.mdDoc "PrivacyIDEA LDAP Proxy");
  
  
negative.code:       (flip mapAttrs cfg.ldap-proxy.settings
          (const (mapAttrs (const renderValue)))));
  
    privacyidea-token-janitor = pkgs.writeShellScriptBin "privacyidea-token-janitor" ''
      exec -a privacyidea-token-janitor \
        /run/wrappers/bin/sudo -u ${cfg.user} \
        env PRIVACYIDEA_CONFIGFILE=${cfg.stateDir}/privacyidea.cfg \
        ${penv}/bin/privacyidea-token-janitor $@
    '';
  in
  
  {
  