anchor.diff:  
       users.ldap = {
   
  -      enable = mkOption {
  -        type = types.bool;
  -        default = false;
  -        description = "Whether to enable authentication against an LDAP server.";
  -      };
  +      enable = mkEnableOption "authentication against an LDAP server";
   
         loginPam = mkOption {
           type = types.bool;
           default = true;
  -        description = "Whether to include authentication against LDAP in login PAM";
  +        description = "Whether to include authentication against LDAP in login PAM.";
         };
   
         nsswitch = mkOption {
           type = types.bool;
           default = true;
  -        description = "Whether to include lookup against LDAP in NSS";
  +        description = "Whether to include lookup against LDAP in NSS.";
         };
   
         server = mkOption {
  
positive.code:             actually contact the directory server, and it is possible that
              a malformed configuration file will trigger reconnection. If
              <literal>soft</literal> is specified, then
              <literal>nss_ldap</literal> will return immediately on server
              failure. All hard reconnect policies block with exponential
              backoff before retrying.
            '';
  
negative.code:           description = ''
              Specifies the time limit (in seconds) to use when connecting
              to the directory server. This is distinct from the time limit
              specified in <option>users.ldap.timeLimit</option> and affects
              the initial server connection only.
            '';
          };
  