anchor.diff:  
       (mkIf cfg.ldap-proxy.enable {
   
  +      assertions = [
  +        { assertion = let
  +            xor = a: b: a && !b || !a && b;
  +          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
  +          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
  +        }
  +      ];
  +
  +      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
  +        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
  +      ];
  +
         systemd.services.privacyidea-ldap-proxy = let
           ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
         in {
  
positive.code:         enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
  
          configFile = mkOption {
            type = types.path;
            description = ''
              Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
            '';
  
negative.code:           type = types.str;
            default = "pi-ldap-proxy";
            description = "Group account under which PrivacyIDEA LDAP proxy runs.";
          };
  
          settings = mkOption {
            type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
            default = {};
            description = ''
              Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
              It's possible to pass secrets using env-vars as substitutes and
              use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
              to inject them via <package>envsubst</package>.
            '';
          };
  
          environmentFile = mkOption {
            default = null;
            type = types.nullOr types.str;
            description = ''
              Environment file containing secrets to be substituted into
              <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
            '';
          };
        };
      };
  