anchor.diff:              uri ${config.users.ldap.server}
               base ${config.users.ldap.base}
   
  -            ${if config.users.ldap.useTLS then ''
  +            ${optionalString config.users.ldap.useTLS ''
                 ssl start_tls
                 tls_checkpeer no
  -            '' else ""}
  +            ''}
  +
  +            ${optionalString (config.users.ldap.bind.distinguishedName != "") ''
  +              binddn ${config.users.ldap.bind.distinguishedName}
  +            ''}
             '';
           target = "ldap.conf";
         }
  
positive.code: 
  ###### interface
  let
    inherit (pkgs.lib) mkOption mkIf;
  
    options = {
      users = {
  
negative.code:     ];
    };
  
    system.activationScripts.ldap = stringAfter [ "etc" ] (
      optionalString (config.users.ldap.bind.distinguishedName != "") ''
        if test -f "${config.users.ldap.bind.password}" ; then
          echo "bindpw $(cat ${config.users.ldap.bind.password})" | cat /etc/ldap.conf - > /etc/ldap.conf.bindpw
          mv -fT /etc/ldap.conf.bindpw /etc/ldap.conf
          chmod 600 /etc/ldap.conf
        fi
      ''
    );
  
  }
  