anchor.diff:      ];
     };
   
  +  system.activationScripts.ldap = stringAfter [ "etc" ] (
  +    optionalString (config.users.ldap.bind.distinguishedName != "") ''
  +      if test -f "${config.users.ldap.bind.password}" ; then
  +        echo "bindpw $(cat ${config.users.ldap.bind.password})" | cat /etc/ldap.conf - > /etc/ldap.conf.bindpw
  +        mv -fT /etc/ldap.conf.bindpw /etc/ldap.conf
  +        chmod 600 /etc/ldap.conf
  +      fi
  +    ''
  +  );
  +
   }
  
positive.code:           ";
          };
  
        };
      };
    };
  
negative.code: 
  ###### interface
  let
    inherit (pkgs.lib) mkOption mkIf optionalString stringAfter;
  
    options = {
      users = {
  