anchor.diff:              '''
             '';
         };
  +
  +      declarativeContents = mkOption {
  +        type = with types; nullOr lines;
  +        default = null;
  +        description = ''
  +          Declarative contents for the LDAP database, in LDIF format.
  +
  +          Note a few facts when using it. First, the database
  +          <emphasis>must</emphasis> be stored in the directory defined by
  +          <code>dataDir</code>. Second, all <code>dataDir</code> will be erased
  +          when starting the LDAP server. Third, modifications to the database
  +          are not prevented, they are just dropped on the next reboot of the
  +          server. Finally, performance-wise the database and indexes are rebuilt
  +          on each server startup, so this will slow down server startup,
  +          especially with large databases.
  +        '';
  +        example = ''
  +          dn: dc=example,dc=org
  +          objectClass: domain
  +          dc: example
  +
  +          dn: ou=users,dc=example,dc=org
  +          objectClass = organizationalUnit
  +          ou: users
  +
  +          # ...
  +        '';
  +      };
       };
   
     };
  
positive.code:   cfg = config.services.openldap;
    openldap = pkgs.openldap;
  
    configFile = pkgs.writeText "slapd.conf" cfg.extraConfig;
    configOpts = if cfg.configDir == null then "-f ${configFile}"
                 else "-F ${cfg.configDir}";
  
negative.code:       preStart = ''
          mkdir -p /var/run/slapd
          chown -R "${cfg.user}:${cfg.group}" /var/run/slapd
          ${optionalString (cfg.declarativeContents != null) ''
            rm -Rf "${cfg.dataDir}"
          ''}
          mkdir -p "${cfg.dataDir}"
          ${optionalString (cfg.declarativeContents != null) ''
            ${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
          ''}
          chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
        '';
        serviceConfig.ExecStart =
  