anchor.diff:            type = types.str;
             default = "pi-ldap-proxy";
             description = "Group account under which PrivacyIDEA LDAP proxy runs.";
  +        };
  +
  +        settings = mkOption {
  +          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
  +          default = {};
  +          description = ''
  +            Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
  +            It's possible to pass secrets using env-vars as substitutes and
  +            use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
  +            to inject them via <package>envsubst</package>.
  +          '';
  +        };
  +
  +        environmentFile = mkOption {
  +          default = null;
  +          type = types.nullOr types.str;
  +          description = ''
  +            Environment file containing secrets to be substituted into
  +            <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
  +          '';
           };
         };
       };
  
positive.code:     ${cfg.extraConfig}
    '';
  
  in
  
  {
  
negative.code: 
      (mkIf cfg.ldap-proxy.enable {
  
        assertions = [
          { assertion = let
              xor = a: b: a && !b || !a && b;
            in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
            message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
          }
        ];
  
        warnings = mkIf (cfg.ldap-proxy.configFile != null) [
          "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
        ];
  
        systemd.services.privacyidea-ldap-proxy = let
          ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
        in {
  