anchor.diff:    # command-line to launch oauth2_proxy.
     providerSpecificOptions = {
       azure = cfg: {
  -      azure.tenant = cfg.azure.tenant;
  +      azure-tenant = cfg.azure.tenant;
         resource = cfg.azure.resource;
       };
   
  
positive.code:     pass-access-token = passAccessToken;
      pass-basic-auth = passBasicAuth;
      pass-host-header = passHostHeader;
      proxy-prefix = proxyPrefix;
      profile-url = profileURL;
      redeem-url = redeemURL;
  
negative.code:       '';
      };
  
      reverseProxy = mkOption {
        type = types.bool;
        default = false;
        description = ''
          In case when running behind a reverse proxy, controls whether headers
  	like <literal>X-Real-Ip</literal> are accepted. Usage behind a reverse
          proxy will require this flag to be set to avoid logging the reverse
          proxy IP address.
        '';
      };
  
      proxyPrefix = mkOption {
        type = types.str;
        default = "/oauth2";
  