anchor.diff:  
                 writeAttribute = attribute: value:
                   let
  -                  type = builtins.typeOf value;
  +                  type = typeOf value;
                   in
                     if type == "set" then
                       let
  -                      names = builtins.attrNames value;
  +                      names = attrNames value;
                       in
  -                      builtins.foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names
  +                      foldl' (text: name: text + (writeAttribute "${attribute}.${name}" value.${name})) "" names
                     else if value == null then ''
                       if (outcome == success) of ${path}:read-attribute(name="${attribute}")
                           ${path}:undefine-attribute(name="${attribute}")
                       end-if
                     ''
  -                  else if builtins.elem type [ "string" "path" "bool" ] then
  +                  else if elem type [ "string" "path" "bool" ] then
                       let
  -                      value' = if type == "bool" then lib.boolToString value else ''"${value}"'';
  +                      value' = if type == "bool" then boolToString value else ''"${value}"'';
                       in ''
                         if (result != ${prefixExpression value'}) of ${path}:read-attribute(name="${attribute}")
                           ${path}:write-attribute(name=${attribute}, value=${value'})
  
positive.code:               driver-class-name = "com.mysql.jdbc.Driver";
              };
              "data-source=KeycloakDS" = {
                connection-url = "jdbc:mysql://${cfg.database.host}:${builtins.toString cfg.database.port}/keycloak";
                driver-name = "mysql";
                "connection-properties=useSSL".value = lib.boolToString cfg.database.useSSL;
                "connection-properties=requireSSL".value = lib.boolToString cfg.database.useSSL;
                "connection-properties=verifyServerCertificate".value = lib.boolToString cfg.database.useSSL;
                "connection-properties=characterEncoding".value = "UTF-8";
                valid-connection-checker-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker";
                validate-on-match = true;
                exception-sorter-class-name = "org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter";
              } // (lib.optionalAttrs (cfg.database.caCert != null) {
                "connection-properties=trustCertificateKeyStoreUrl".value = "file:${mySqlCaKeystore}";
                "connection-properties=trustCertificateKeyStorePassword".value = "notsosecretpassword";
              });
            };
          })
          (lib.optionalAttrs (cfg.sslCertificate != null && cfg.sslCertificateKey != null) {
            "socket-binding-group=standard-sockets"."socket-binding=https".port = cfg.httpsPort;
            "subsystem=elytron" = lib.mkOrder 900 {
              "key-store=httpsKS" = lib.mkOrder 900 {
                path = "/run/keycloak/ssl/certificate_private_key_bundle.p12";
                credential-reference.clear-text = "notsosecretpassword";
                type = "JKS";
              };
              "key-manager=httpsKM" = lib.mkOrder 901 {
                key-store = "httpsKS";
                credential-reference.clear-text = "notsosecretpassword";
              };
              "server-ssl-context=httpsSSC" = lib.mkOrder 902 {
                key-manager = "httpsKM";
              };
            };
            "subsystem=undertow" = lib.mkOrder 901 {
              "server=default-server"."https-listener=https".ssl-context = "httpsSSC";
            };
          })
  
negative.code:         cp configuration/standalone.xml $out
        '';
      in
        mkIf cfg.enable {
  
          assertions = [
            {
  