anchor.diff:  
               Note that reloading the <literal>taskserver.service</literal> causes
               a configuration file reload before the next request is handled.
  -          '';
  -        };
  -
  -        trust = mkOption {
  -          type = types.enum [ "allow all" "strict" ];
  -          default = "strict";
  -          description = ''
  -            Determines how client certificates are validated.
  -
  -            The value <literal>allow all</literal> performs no client
  -            certificate validation. This is not recommended. The value
  -            <literal>strict</literal> causes the client certificate to be
  -            validated against a CA.
             '';
           };
         };
  
positive.code:         '';
        };
  
        pki = {
          cert = mkOption {
            type = types.nullOr types.path;
  
negative.code:     ${mkConfLine "server.crl" cfg.pki.crl}
  
      # certificates
      ${mkConfLine "trust" cfg.trust}
      ${if needToCreateCA then ''
        ca.cert = ${cfg.dataDir}/keys/ca.cert
        server.cert = ${cfg.dataDir}/keys/server.cert
  