anchor.diff:            ";
           };
   
  +        bind = {
  +          distinguishedName = mkOption {
  +            default = "";
  +            example = "cn=admin,dc=example,dc=com";
  +            type = with pkgs.lib.types; string;
  +            description = "
  +              The distinguished name to bind to the LDAP server with. If this
  +              is not specified, an anonymous bind will be done.
  +            ";
  +          };
  +
  +          password = mkOption {
  +            default = "/etc/ldap/bind.password";
  +            type = with pkgs.lib.types; string;
  +            description = "
  +              The path to a file containing the credentials to use when binding
  +              to the LDAP server (if not binding anonymously).
  +            ";
  +          };
  +        };
  +
         };
       };
     };
  
positive.code: 
  ###### interface
  let
    inherit (pkgs.lib) mkOption mkIf;
  
    options = {
      users = {
  
negative.code:             uri ${config.users.ldap.server}
              base ${config.users.ldap.base}
  
              ${optionalString config.users.ldap.useTLS ''
                ssl start_tls
                tls_checkpeer no
              ''}
  
              ${optionalString (config.users.ldap.bind.distinguishedName != "") ''
                binddn ${config.users.ldap.bind.distinguishedName}
              ''}
            '';
          target = "ldap.conf";
        }
  