anchor.diff:        extraConfig = mkOption {
           type = types.attrs;
           default = {};
  -        example = {
  -          gitlab = {
  -            default_projects_features = {
  -              builds = false;
  +        example = literalExample ''
  +          {
  +            gitlab = {
  +              default_projects_features = {
  +                builds = false;
  +              };
  +            };
  +            omniauth = {
  +              enabled = true;
  +              auto_sign_in_with_provider = "openid_connect";
  +              allow_single_sign_on = ["openid_connect"];
  +              block_auto_created_users = false;
  +              providers = [
  +                {
  +                  name = "openid_connect";
  +                  label = "OpenID Connect";
  +                  args = {
  +                    name = "openid_connect";
  +                    scope = ["openid" "profile"];
  +                    response_type = "code";
  +                    issuer = "https://keycloak.example.com/auth/realms/My%20Realm";
  +                    discovery = true;
  +                    client_auth_method = "query";
  +                    uid_field = "preferred_username";
  +                    client_options = {
  +                      identifier = "gitlab";
  +                      secret = { _secret = "/var/keys/gitlab_oidc_secret"; };
  +                      redirect_uri = "https://git.example.com/users/auth/openid_connect/callback";
  +                    };
  +                  };
  +                }
  +              ];
               };
             };
  -        };
  -        description = ''
  -          Extra options to be merged into config/gitlab.yml as nix
  -          attribute set.
  +        '';
  +        description = ''
  +          Extra options to be added under
  +          <literal>production</literal> in
  +          <filename>config/gitlab.yml</filename>, as a nix attribute
  +          set.
  +
  +          Options containing secret data should be set to an attribute
  +          set containing the attribute <literal>_secret</literal> - a
  +          string pointing to a file containing the value the option
  +          should be set to. See the example to get a better picture of
  +          this: in the resulting
  +          <filename>config/gitlab.yml</filename> file, the
  +          <literal>production.omniauth.providers[0].args.client_options.secret</literal>
  +          key will be set to the contents of the
  +          <filename>/var/keys/gitlab_oidc_secret</filename> file.
           '';
         };
       };
  
positive.code: 
        "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
  
        "L+ ${cfg.statePath}/config/gitlab.yml - - - - ${pkgs.writeText "gitlab.yml" (builtins.toJSON gitlabConfig)}"
        "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
        "L+ ${cfg.statePath}/config/initializers/extra-gitlab.rb - - - - ${extraGitlabRb}"
      ];
  
negative.code: { config, lib, pkgs, utils, ... }:
  
  # TODO: support non-postgresql
  
  