anchor.diff:        };
   
         failmode = mkOption {
  -        type = types.str;
  +        type = types.enum [ "safe" "enum" ];
           default = "safe";
           description = ''
             On service or configuration errors that prevent Duo
  
positive.code:       };
  
        prompts = mkOption {
          type = types.int;
          default = 3;
          description = ''
            If a user fails to authenticate with a second factor, Duo
  
negative.code: 
    config = mkIf (cfg.ssh.enable || cfg.pam.enable) {
      assertions =
        [ { assertion = !cfg.pam.enable;
            message   = "PAM support is currently not implemented.";
          }
        ];
  