anchor.diff:  let
     cfg = config.services.keycloak;
     opt = options.services.keycloak;
  +
  +  inherit (lib) types mkOption concatStringsSep mapAttrsToList
  +    escapeShellArg recursiveUpdate optionalAttrs boolToString mkOrder
  +    sort filterAttrs concatMapStringsSep concatStrings mkIf
  +    optionalString optionals mkDefault literalExpression hasSuffix
  +    foldl' isAttrs filter attrNames elem literalDocBook
  +    maintainers;
  +
  +  inherit (builtins) match typeOf;
   in
   {
  -  options.services.keycloak = {
  -
  -    enable = lib.mkOption {
  -      type = lib.types.bool;
  -      default = false;
  -      example = true;
  -      description = ''
  -        Whether to enable the Keycloak identity and access management
  -        server.
  -      '';
  -    };
  -
  -    bindAddress = lib.mkOption {
  -      type = lib.types.str;
  -      default = "\${jboss.bind.address:0.0.0.0}";
  -      example = "127.0.0.1";
  -      description = ''
  -        On which address Keycloak should accept new connections.
  -
  -        A special syntax can be used to allow command line Java system
  -        properties to override the value: ''${property.name:value}
  -      '';
  -    };
  -
  -    httpPort = lib.mkOption {
  -      type = lib.types.str;
  -      default = "\${jboss.http.port:80}";
  -      example = "8080";
  -      description = ''
  -        On which port Keycloak should listen for new HTTP connections.
  -
  -        A special syntax can be used to allow command line Java system
  -        properties to override the value: ''${property.name:value}
  -      '';
  -    };
  -
  -    httpsPort = lib.mkOption {
  -      type = lib.types.str;
  -      default = "\${jboss.https.port:443}";
  -      example = "8443";
  -      description = ''
  -        On which port Keycloak should listen for new HTTPS connections.
  -
  -        A special syntax can be used to allow command line Java system
  -        properties to override the value: ''${property.name:value}
  -      '';
  -    };
  -
  -    frontendUrl = lib.mkOption {
  -      type = lib.types.str;
  -      apply = x:
  -        if x == "" || lib.hasSuffix "/" x then
  -          x
  -        else
  -          x + "/";
  -      example = "keycloak.example.com/auth";
  -      description = ''
  -        The public URL used as base for all frontend requests. Should
  -        normally include a trailing <literal>/auth</literal>.
  -
  -        See <link xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
  -        Hostname section of the Keycloak server installation
  -        manual</link> for more information.
  -      '';
  -    };
  -
  -    forceBackendUrlToFrontendUrl = lib.mkOption {
  -      type = lib.types.bool;
  -      default = false;
  -      example = true;
  -      description = ''
  -        Whether Keycloak should force all requests to go through the
  -        frontend URL configured in <xref
  -        linkend="opt-services.keycloak.frontendUrl" />. By default,
  -        Keycloak allows backend requests to instead use its local
  -        hostname or IP address and may also advertise it to clients
  -        through its OpenID Connect Discovery endpoint.
  -
  -        See <link
  -        xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
  -        Hostname section of the Keycloak server installation
  -        manual</link> for more information.
  -      '';
  -    };
  -
  -    sslCertificate = lib.mkOption {
  -      type = lib.types.nullOr lib.types.path;
  -      default = null;
  -      example = "/run/keys/ssl_cert";
  -      description = ''
  -        The path to a PEM formatted certificate to use for TLS/SSL
  -        connections.
  -
  -        This should be a string, not a Nix path, since Nix paths are
  -        copied into the world-readable Nix store.
  -      '';
  -    };
  -
  -    sslCertificateKey = lib.mkOption {
  -      type = lib.types.nullOr lib.types.path;
  -      default = null;
  -      example = "/run/keys/ssl_key";
  -      description = ''
  -        The path to a PEM formatted private key to use for TLS/SSL
  -        connections.
  -
  -        This should be a string, not a Nix path, since Nix paths are
  -        copied into the world-readable Nix store.
  -      '';
  -    };
  -
  -    database = {
  -      type = lib.mkOption {
  -        type = lib.types.enum [ "mysql" "postgresql" ];
  -        default = "postgresql";
  -        example = "mysql";
  -        description = ''
  -          The type of database Keycloak should connect to.
  -        '';
  -      };
  -
  -      host = lib.mkOption {
  -        type = lib.types.str;
  -        default = "localhost";
  -        description = ''
  -          Hostname of the database to connect to.
  -        '';
  -      };
  -
  -      port =
  -        let
  -          dbPorts = {
  -            postgresql = 5432;
  -            mysql = 3306;
  -          };
  -        in
  -          lib.mkOption {
  -            type = lib.types.port;
  +  options.services.keycloak =
  +    let
  +      inherit (types) bool str nullOr attrsOf path enum anything
  +        package port;
  +    in
  +    {
  +      enable = mkOption {
  +        type = bool;
  +        default = false;
  +        example = true;
  +        description = ''
  +          Whether to enable the Keycloak identity and access management
  +          server.
  +        '';
  +      };
  +
  +      bindAddress = mkOption {
  +        type = str;
  +        default = "\${jboss.bind.address:0.0.0.0}";
  +        example = "127.0.0.1";
  +        description = ''
  +          On which address Keycloak should accept new connections.
  +
  +          A special syntax can be used to allow command line Java system
  +          properties to override the value: ''${property.name:value}
  +        '';
  +      };
  +
  +      httpPort = mkOption {
  +        type = str;
  +        default = "\${jboss.http.port:80}";
  +        example = "8080";
  +        description = ''
  +          On which port Keycloak should listen for new HTTP connections.
  +
  +          A special syntax can be used to allow command line Java system
  +          properties to override the value: ''${property.name:value}
  +        '';
  +      };
  +
  +      httpsPort = mkOption {
  +        type = str;
  +        default = "\${jboss.https.port:443}";
  +        example = "8443";
  +        description = ''
  +          On which port Keycloak should listen for new HTTPS connections.
  +
  +          A special syntax can be used to allow command line Java system
  +          properties to override the value: ''${property.name:value}
  +        '';
  +      };
  +
  +      frontendUrl = mkOption {
  +        type = str;
  +        apply = x:
  +          if x == "" || hasSuffix "/" x then
  +            x
  +          else
  +            x + "/";
  +        example = "keycloak.example.com/auth";
  +        description = ''
  +          The public URL used as base for all frontend requests. Should
  +          normally include a trailing <literal>/auth</literal>.
  +
  +          See <link xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
  +          Hostname section of the Keycloak server installation
  +          manual</link> for more information.
  +        '';
  +      };
  +
  +      forceBackendUrlToFrontendUrl = mkOption {
  +        type = bool;
  +        default = false;
  +        example = true;
  +        description = ''
  +          Whether Keycloak should force all requests to go through the
  +          frontend URL configured in <xref
  +          linkend="opt-services.keycloak.frontendUrl" />. By default,
  +          Keycloak allows backend requests to instead use its local
  +          hostname or IP address and may also advertise it to clients
  +          through its OpenID Connect Discovery endpoint.
  +
  +          See <link
  +          xlink:href="https://www.keycloak.org/docs/latest/server_installation/#_hostname">the
  +          Hostname section of the Keycloak server installation
  +          manual</link> for more information.
  +        '';
  +      };
  +
  +      sslCertificate = mkOption {
  +        type = nullOr path;
  +        default = null;
  +        example = "/run/keys/ssl_cert";
  +        description = ''
  +          The path to a PEM formatted certificate to use for TLS/SSL
  +          connections.
  +
  +          This should be a string, not a Nix path, since Nix paths are
  +          copied into the world-readable Nix store.
  +        '';
  +      };
  +
  +      sslCertificateKey = mkOption {
  +        type = nullOr path;
  +        default = null;
  +        example = "/run/keys/ssl_key";
  +        description = ''
  +          The path to a PEM formatted private key to use for TLS/SSL
  +          connections.
  +
  +          This should be a string, not a Nix path, since Nix paths are
  +          copied into the world-readable Nix store.
  +        '';
  +      };
  +
  +      database = {
  +        type = mkOption {
  +          type = enum [ "mysql" "postgresql" ];
  +          default = "postgresql";
  +          example = "mysql";
  +          description = ''
  +            The type of database Keycloak should connect to.
  +          '';
  +        };
  +
  +        host = mkOption {
  +          type = str;
  +          default = "localhost";
  +          description = ''
  +            Hostname of the database to connect to.
  +          '';
  +        };
  +
  +        port =
  +          let
  +            dbPorts = {
  +              postgresql = 5432;
  +              mysql = 3306;
  +            };
  +          in
  +          mkOption {
  +            type = port;
               default = dbPorts.${cfg.database.type};
  -            defaultText = lib.literalDocBook "default port of selected database";
  +            defaultText = literalDocBook "default port of selected database";
               description = ''
                 Port of the database to connect to.
               '';
             };
   
  -      useSSL = lib.mkOption {
  -        type = lib.types.bool;
  -        default = cfg.database.host != "localhost";
  -        defaultText = lib.literalExpression ''config.${opt.database.host} != "localhost"'';
  -        description = ''
  -          Whether the database connection should be secured by SSL /
  -          TLS.
  -        '';
  -      };
  -
  -      caCert = lib.mkOption {
  -        type = lib.types.nullOr lib.types.path;
  -        default = null;
  -        description = ''
  -          The SSL / TLS CA certificate that verifies the identity of the
  -          database server.
  -
  -          Required when PostgreSQL is used and SSL is turned on.
  -
  -          For MySQL, if left at <literal>null</literal>, the default
  -          Java keystore is used, which should suffice if the server
  -          certificate is issued by an official CA.
  -        '';
  -      };
  -
  -      createLocally = lib.mkOption {
  -        type = lib.types.bool;
  -        default = true;
  -        description = ''
  -          Whether a database should be automatically created on the
  -          local host. Set this to false if you plan on provisioning a
  -          local database yourself. This has no effect if
  -          services.keycloak.database.host is customized.
  -        '';
  -      };
  -
  -      username = lib.mkOption {
  -        type = lib.types.str;
  -        default = "keycloak";
  -        description = ''
  -          Username to use when connecting to an external or manually
  -          provisioned database; has no effect when a local database is
  -          automatically provisioned.
  -
  -          To use this with a local database, set <xref
  -          linkend="opt-services.keycloak.database.createLocally" /> to
  -          <literal>false</literal> and create the database and user
  -          manually. The database should be called
  -          <literal>keycloak</literal>.
  -        '';
  -      };
  -
  -      passwordFile = lib.mkOption {
  -        type = lib.types.path;
  -        example = "/run/keys/db_password";
  -        description = ''
  -          File containing the database password.
  -
  -          This should be a string, not a Nix path, since Nix paths are
  -          copied into the world-readable Nix store.
  -        '';
  -      };
  +        useSSL = mkOption {
  +          type = bool;
  +          default = cfg.database.host != "localhost";
  +          defaultText = literalExpression ''config.${opt.database.host} != "localhost"'';
  +          description = ''
  +            Whether the database connection should be secured by SSL /
  +            TLS.
  +          '';
  +        };
  +
  +        caCert = mkOption {
  +          type = nullOr path;
  +          default = null;
  +          description = ''
  +            The SSL / TLS CA certificate that verifies the identity of the
  +            database server.
  +
  +            Required when PostgreSQL is used and SSL is turned on.
  +
  +            For MySQL, if left at <literal>null</literal>, the default
  +            Java keystore is used, which should suffice if the server
  +            certificate is issued by an official CA.
  +          '';
  +        };
  +
  +        createLocally = mkOption {
  +          type = bool;
  +          default = true;
  +          description = ''
  +            Whether a database should be automatically created on the
  +            local host. Set this to false if you plan on provisioning a
  +            local database yourself. This has no effect if
  +            services.keycloak.database.host is customized.
  +          '';
  +        };
  +
  +        username = mkOption {
  +          type = str;
  +          default = "keycloak";
  +          description = ''
  +            Username to use when connecting to an external or manually
  +            provisioned database; has no effect when a local database is
  +            automatically provisioned.
  +
  +            To use this with a local database, set <xref
  +            linkend="opt-services.keycloak.database.createLocally" /> to
  +            <literal>false</literal> and create the database and user
  +            manually. The database should be called
  +            <literal>keycloak</literal>.
  +          '';
  +        };
  +
  +        passwordFile = mkOption {
  +          type = path;
  +          example = "/run/keys/db_password";
  +          description = ''
  +            File containing the database password.
  +
  +            This should be a string, not a Nix path, since Nix paths are
  +            copied into the world-readable Nix store.
  +          '';
  +        };
  +      };
  +
  +      package = mkOption {
  +        type = package;
  +        default = pkgs.keycloak;
  +        defaultText = literalExpression "pkgs.keycloak";
  +        description = ''
  +          Keycloak package to use.
  +        '';
  +      };
  +
  +      initialAdminPassword = mkOption {
  +        type = str;
  +        default = "changeme";
  +        description = ''
  +          Initial password set for the <literal>admin</literal>
  +          user. The password is not stored safely and should be changed
  +          immediately in the admin panel.
  +        '';
  +      };
  +
  +      themes = mkOption {
  +        type = attrsOf package;
  +        default = { };
  +        description = ''
  +          Additional theme packages for Keycloak. Each theme is linked into
  +          subdirectory with a corresponding attribute name.
  +
  +          Theme packages consist of several subdirectories which provide
  +          different theme types: for example, <literal>account</literal>,
  +          <literal>login</literal> etc. After adding a theme to this option you
  +          can select it by its name in Keycloak administration console.
  +        '';
  +      };
  +
  +      extraConfig = mkOption {
  +        type = attrsOf anything;
  +        default = { };
  +        example = literalExpression ''
  +          {
  +            "subsystem=keycloak-server" = {
  +              "spi=hostname" = {
  +                "provider=default" = null;
  +                "provider=fixed" = {
  +                  enabled = true;
  +                  properties.hostname = "keycloak.example.com";
  +                };
  +                default-provider = "fixed";
  +              };
  +            };
  +          }
  +        '';
  +        description = ''
  +          Additional Keycloak configuration options to set in
  +          <literal>standalone.xml</literal>.
  +
  +          Options are expressed as a Nix attribute set which matches the
  +          structure of the jboss-cli configuration. The configuration is
  +          effectively overlayed on top of the default configuration
  +          shipped with Keycloak. To remove existing nodes and undefine
  +          attributes from the default configuration, set them to
  +          <literal>null</literal>.
  +
  +          The example configuration does the equivalent of the following
  +          script, which removes the hostname provider
  +          <literal>default</literal>, adds the deprecated hostname
  +          provider <literal>fixed</literal> and defines it the default:
  +
  +          <programlisting>
  +          /subsystem=keycloak-server/spi=hostname/provider=default:remove()
  +          /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" })
  +          /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed")
  +          </programlisting>
  +
  +          You can discover available options by using the <link
  +          xlink:href="http://docs.wildfly.org/21/Admin_Guide.html#Command_Line_Interface">jboss-cli.sh</link>
  +          program and by referring to the <link
  +          xlink:href="https://www.keycloak.org/docs/latest/server_installation/index.html">Keycloak
  +          Server Installation and Configuration Guide</link>.
  +        '';
  +      };
  +
       };
  -
  -    package = lib.mkOption {
  -      type = lib.types.package;
  -      default = pkgs.keycloak;
  -      defaultText = lib.literalExpression "pkgs.keycloak";
  -      description = ''
  -        Keycloak package to use.
  -      '';
  -    };
  -
  -    initialAdminPassword = lib.mkOption {
  -      type = lib.types.str;
  -      default = "changeme";
  -      description = ''
  -        Initial password set for the <literal>admin</literal>
  -        user. The password is not stored safely and should be changed
  -        immediately in the admin panel.
  -      '';
  -    };
  -
  -    themes = lib.mkOption {
  -      type = lib.types.attrsOf lib.types.package;
  -      default = {};
  -      description = ''
  -        Additional theme packages for Keycloak. Each theme is linked into
  -        subdirectory with a corresponding attribute name.
  -
  -        Theme packages consist of several subdirectories which provide
  -        different theme types: for example, <literal>account</literal>,
  -        <literal>login</literal> etc. After adding a theme to this option you
  -        can select it by its name in Keycloak administration console.
  -      '';
  -    };
  -
  -    extraConfig = lib.mkOption {
  -      type = lib.types.attrsOf lib.types.anything;
  -      default = { };
  -      example = lib.literalExpression ''
  -        {
  -          "subsystem=keycloak-server" = {
  -            "spi=hostname" = {
  -              "provider=default" = null;
  -              "provider=fixed" = {
  -                enabled = true;
  -                properties.hostname = "keycloak.example.com";
  -              };
  -              default-provider = "fixed";
  -            };
  -          };
  -        }
  -      '';
  -      description = ''
  -        Additional Keycloak configuration options to set in
  -        <literal>standalone.xml</literal>.
  -
  -        Options are expressed as a Nix attribute set which matches the
  -        structure of the jboss-cli configuration. The configuration is
  -        effectively overlayed on top of the default configuration
  -        shipped with Keycloak. To remove existing nodes and undefine
  -        attributes from the default configuration, set them to
  -        <literal>null</literal>.
  -
  -        The example configuration does the equivalent of the following
  -        script, which removes the hostname provider
  -        <literal>default</literal>, adds the deprecated hostname
  -        provider <literal>fixed</literal> and defines it the default:
  -
  -        <programlisting>
  -        /subsystem=keycloak-server/spi=hostname/provider=default:remove()
  -        /subsystem=keycloak-server/spi=hostname/provider=fixed:add(enabled = true, properties = { hostname = "keycloak.example.com" })
  -        /subsystem=keycloak-server/spi=hostname:write-attribute(name=default-provider, value="fixed")
  -        </programlisting>
  -
  -        You can discover available options by using the <link
  -        xlink:href="http://docs.wildfly.org/21/Admin_Guide.html#Command_Line_Interface">jboss-cli.sh</link>
  -        program and by referring to the <link
  -        xlink:href="https://www.keycloak.org/docs/latest/server_installation/index.html">Keycloak
  -        Server Installation and Configuration Guide</link>.
  -      '';
  -    };
  -
  -  };
   
     config =
       let
  
positive.code:                     ''
                    else throw "Unsupported type '${type}' for path '${path}'!";
              in
                lib.concatStrings
                  (lib.mapAttrsToList
                    (attribute: value: (writeAttribute attribute value))
                    set);
  
  
negative.code:               # with `expression` to evaluate.
                prefixExpression = string:
                  let
                    matchResult = match ''"\$\{.*}"'' string;
                  in
                    if matchResult != null then
                      "expression " + string
  