anchor.diff:      ];
     };
   
  +  system.activationScripts.ldap = stringAfter [ "etc" ] (
  +    optionalString (config.users.ldap.bind.distinguishedName != "") ''
  +      if test -f "${config.users.ldap.bind.password}" ; then
  +        echo "bindpw $(cat ${config.users.ldap.bind.password})" | cat /etc/ldap.conf - > /etc/ldap.conf.bindpw
  +        mv -fT /etc/ldap.conf.bindpw /etc/ldap.conf
  +        chmod 600 /etc/ldap.conf
  +      fi
  +    ''
  +  );
  +
   }
  
positive.code: 
  ###### interface
  let
    inherit (pkgs.lib) mkOption mkIf;
  
    options = {
      users = {
  
negative.code:           ";
          };
  
          bind = {
            distinguishedName = mkOption {
              default = "";
              example = "cn=admin,dc=example,dc=com";
              type = with pkgs.lib.types; string;
              description = "
                The distinguished name to bind to the LDAP server with. If this
                is not specified, an anonymous bind will be done.
              ";
            };
  
            password = mkOption {
              default = "/etc/ldap/bind.password";
              type = with pkgs.lib.types; string;
              description = "
                The path to a file containing the credentials to use when binding
                to the LDAP server (if not binding anonymously).
              ";
            };
          };
  
        };
      };
    };
  