anchor.diff:  
       (mkIf cfg.ldap-proxy.enable {
   
  +      assertions = [
  +        { assertion = let
  +            xor = a: b: a && !b || !a && b;
  +          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
  +          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
  +        }
  +      ];
  +
  +      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
  +        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
  +      ];
  +
         systemd.services.privacyidea-ldap-proxy = let
           ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
         in {
  
positive.code:         serviceConfig = {
            User = cfg.ldap-proxy.user;
            Group = cfg.ldap-proxy.group;
            ExecStart = ''
              ${ldap-proxy-env}/bin/twistd \
                --nodaemon \
                --pidfile= \
                -u ${cfg.ldap-proxy.user} \
                -g ${cfg.ldap-proxy.group} \
                ldap-proxy \
                -c ${cfg.ldap-proxy.configFile}
            '';
            Restart = "always";
          };
  
negative.code:         enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
  
          configFile = mkOption {
            type = types.nullOr types.path;
            default = null;
            description = ''
              Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
            '';
  