anchor.diff:      };
   
       clientID = mkOption {
  -      type = types.str;
  +      type = types.nullOr types.str;
         description = ''
           The OAuth Client ID.
         '';
  
positive.code:       inherit (cfg.github) org team;
      }; };
  
      google = cfg: { google = with cfg.google; {
        admin-email = adminEmail;
        service-account = serviceAccountJSON;
        group = groups;
  
negative.code:       '';
      };
  
      keyFile = mkOption {
        type = types.nullOr types.string;
        default = null;
        description = ''
          oauth2_proxy allows passing sensitive configuration via environment variables.
          Make a file that contains lines like
          OAUTH2_PROXY_CLIENT_SECRET=asdfasdfasdf.apps.googleuserscontent.com
          and specify the path here.
        '';
        example = "/run/keys/oauth2_proxy";
      };
  
    };
  
    config = mkIf cfg.enable {
  
      services.oauth2_proxy = mkIf (!isNull cfg.keyFile) {
        clientID = mkDefault null;
        clientSecret = mkDefault null;
        cookie.secret = mkDefault null;
      };
  
      users.extraUsers.oauth2_proxy = {
        description = "OAuth2 Proxy";
  