anchor.diff:          enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
   
           configFile = mkOption {
  -          type = types.path;
  +          type = types.nullOr types.path;
  +          default = null;
             description = ''
               Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
             '';
  
positive.code:         serviceConfig = {
            User = cfg.ldap-proxy.user;
            Group = cfg.ldap-proxy.group;
            ExecStart = ''
              ${ldap-proxy-env}/bin/twistd \
                --nodaemon \
                --pidfile= \
                -u ${cfg.ldap-proxy.user} \
                -g ${cfg.ldap-proxy.group} \
                ldap-proxy \
                -c ${cfg.ldap-proxy.configFile}
            '';
            Restart = "always";
          };
  
negative.code:     ${cfg.extraConfig}
    '';
  
    renderValue = x:
      if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
      else if isString x && hasInfix "," x then ''"${x}"''
      else x;
  
    ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
      (generators.toINI {}
        (flip mapAttrs cfg.ldap-proxy.settings
          (const (mapAttrs (const renderValue)))));
  
  in
  
  {
  