anchor.diff:        serviceConfig = {
           User = "oauth2_proxy";
           Restart = "always";
  -        ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${mkCommandLine cfg}";
  +        ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${configString}";
         };
       };
   
  
positive.code: with lib;
  let
    cfg = config.services.oauth2_proxy;
  
    # Use like:
    #   repeatedArgs (arg: "--arg=${arg}") args
    repeatedArgs = concatMapStringsSep " ";
  
    # oauth2_proxy provides many options that are only relevant if you are using
    # a certain provider. This set maps from provider name to a function that
    # takes the configuration and returns a string that can be inserted into the
    # command-line to launch oauth2_proxy.
    providerSpecificOptions = {
      azure = cfg: ''
        --azure-tenant=${cfg.azure.tenant} \
        --resource=${cfg.azure.resource} \
      '';
  
      github = cfg: ''
        ${optionalString (!isNull cfg.github.org) "--github-org=${cfg.github.org}"} \
        ${optionalString (!isNull cfg.github.team) "--github-org=${cfg.github.team}"} \
      '';
  
      google = cfg: ''
        --google-admin-email=${cfg.google.adminEmail} \
        --google-service-account=${cfg.google.serviceAccountJSON} \
        ${repeatedArgs (group: "--google-group=${group}") cfg.google.groups} \
      '';
    };
  
    authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses;
  
    getProviderOptions = cfg: provider: providerSpecificOptions.${provider} or (_: "") cfg;
  
    mkCommandLine = cfg: ''
      --provider='${cfg.provider}' \
      ${optionalString (!isNull cfg.email.addresses) "--authenticated-emails-file='${authenticatedEmailsFile}'"} \
      --approval-prompt='${cfg.approvalPrompt}' \
      ${optionalString (cfg.passBasicAuth && !isNull cfg.basicAuthPassword) "--basic-auth-password='${cfg.basicAuthPassword}'"} \
      --client-id='${cfg.clientID}' \
      --client-secret='${cfg.clientSecret}' \
      ${optionalString (!isNull cfg.cookie.domain) "--cookie-domain='${cfg.cookie.domain}'"} \
      --cookie-expire='${cfg.cookie.expire}' \
      --cookie-httponly=${boolToString cfg.cookie.httpOnly} \
      --cookie-name='${cfg.cookie.name}' \
      --cookie-secret='${cfg.cookie.secret}' \
      --cookie-secure=${boolToString cfg.cookie.secure} \
      ${optionalString (!isNull cfg.cookie.refresh) "--cookie-refresh='${cfg.cookie.refresh}'"} \
      ${optionalString (!isNull cfg.customTemplatesDir) "--custom-templates-dir='${cfg.customTemplatesDir}'"} \
      ${repeatedArgs (x: "--email-domain='${x}'") cfg.email.domains} \
      --http-address='${cfg.httpAddress}' \
      ${optionalString (!isNull cfg.htpasswd.file) "--htpasswd-file='${cfg.htpasswd.file}' --display-htpasswd-form=${boolToString cfg.htpasswd.displayForm}"} \
      ${optionalString (!isNull cfg.loginURL) "--login-url='${cfg.loginURL}'"} \
      --pass-access-token=${boolToString cfg.passAccessToken} \
      --pass-basic-auth=${boolToString cfg.passBasicAuth} \
      --pass-host-header=${boolToString cfg.passHostHeader} \
      --proxy-prefix='${cfg.proxyPrefix}' \
      ${optionalString (!isNull cfg.profileURL) "--profile-url='${cfg.profileURL}'"} \
      ${optionalString (!isNull cfg.redeemURL) "--redeem-url='${cfg.redeemURL}'"} \
      ${optionalString (!isNull cfg.redirectURL) "--redirect-url='${cfg.redirectURL}'"} \
      --request-logging=${boolToString cfg.requestLogging} \
      ${optionalString (!isNull cfg.scope) "--scope='${cfg.scope}'"} \
      ${repeatedArgs (x: "--skip-auth-regex='${x}'") cfg.skipAuthRegexes} \
      ${optionalString (!isNull cfg.signatureKey) "--signature-key='${cfg.signatureKey}'"} \
      --upstream='${cfg.upstream}' \
      ${optionalString (!isNull cfg.validateURL) "--validate-url='${cfg.validateURL}'"} \
      ${optionalString cfg.tls.enable "--tls-cert='${cfg.tls.certificate}' --tls-key='${cfg.tls.key}' --https-address='${cfg.tls.httpsAddress}'"} \
    '' + getProviderOptions cfg cfg.provider;
  in
  {
    options.services.oauth2_proxy = {
  
negative.code:       default = null;
        description = ''
        	Profile access endpoint.
        '';
      };
  
      extraConfig = mkOption {
        default = {};
        description = ''
          Extra config to pass to oauth2_proxy.
        '';
      };
  
  