anchor.diff:        [ global ]
         security = ${cfg.securityType}
         passwd program = /var/setuid-wrappers/passwd %u
  -      pam password change = ${if cfg.syncPasswordsByPam then "yes" else "no"}
  -      invalid users = ${toString cfg.invalidUsers}
  +      pam password change = ${smbToString cfg.syncPasswordsByPam}
  +      invalid users = ${smbToString cfg.invalidUsers}
   
         ${cfg.extraConfig}
   
  -      ${toString (map shareConfig (attrNames cfg.shares))}
  +      ${smbToString (map shareConfig (attrNames cfg.shares))}
       '');
   
     # This may include nss_ldap, needed for samba if it has to use ldap.
  
positive.code: with lib;
  
  let
  
    cfg = config.services.samba;
  
  
negative.code: 
    shareConfig = name:
      let share = getAttr name cfg.shares; in
      "[${name}]\n " + (smbToString (
         map
           (key: "${key} = ${smbToString (getAttr key share)}\n")
           (attrNames share)
      ));
  
  