anchor.diff:        serviceConfig = {
           User = "oauth2_proxy";
           Restart = "always";
  -        ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${mkCommandLine cfg}";
  +        ExecStart = "${cfg.package.bin}/bin/oauth2_proxy ${configString}";
         };
       };
   
  
positive.code:       };
  
        secret = mkOption {
          type = types.str;
          description = ''
            The seed string for secure cookies.
          '';
  
negative.code: with lib;
  let
    cfg = config.services.oauth2_proxy;
  
    # oauth2_proxy provides many options that are only relevant if you are using
    # a certain provider. This set maps from provider name to a function that
    # takes the configuration and returns a string that can be inserted into the
    # command-line to launch oauth2_proxy.
    providerSpecificOptions = {
      azure = cfg: {
        azure.tenant = cfg.azure.tenant;
        resource = cfg.azure.resource;
      };
  
      github = cfg: { github = {
        inherit (cfg.github) org team;
      }; };
  
      google = cfg: { google = with cfg.google; {
        admin-email = adminEmail;
        service-account = serviceAccountJSON;
        group = groups;
      }; };
    };
  
    authenticatedEmailsFile = pkgs.writeText "authenticated-emails" cfg.email.addresses;
  
    getProviderOptions = cfg: provider: providerSpecificOptions.${provider} or (_: {}) cfg;
  
    allConfig = with cfg; {
      inherit (cfg) provider scope upstream;
      approval-prompt = approvalPrompt;
      basic-auth-password = basicAuthPassword;
      client-id = clientID;
      client-secret = clientSecret;
      custom-templates-dir = customTemplatesDir;
      email-domain = email.domains;
      http-address = httpAddress;
      login-url = loginURL;
      pass-access-token = passAccessToken;
      pass-basic-auth = passBasicAuth;
      pass-host-header = passHostHeader;
      proxy-prefix = proxyPrefix;
      profile-url = profileURL;
      redeem-url = redeemURL;
      redirect-url = redirectURL;
      request-logging = requestLogging;
      skip-auth-regex = skipAuthRegexes;
      signature-key = signatureKey;
      validate-url = validateURL;
      htpasswd-file = htpasswd.file;
      cookie = {
        inherit (cookie) domain secure expire name secret refresh;
        httponly = cookie.httpOnly;
      };
    } // lib.optionalAttrs (!isNull cfg.email.addresses) {
      authenticated-emails-file = authenticatedEmailsFile;
    } // lib.optionalAttrs (cfg.passBasicAuth) {
      basic-auth-password = cfg.basicAuthPassword;
    } // lib.optionalAttrs (!isNull cfg.htpasswd.file) {
      display-htpasswd-file = cfg.htpasswd.displayForm;
    } // lib.optionalAttrs tls.enable {
      tls-cert = tls.certificate;
      tls-key = tls.key;
      https-address = tls.httpsAddress;
    } // (getProviderOptions cfg cfg.provider) // cfg.extraConfig;
  
    mapConfig = key: attr:
    if (!isNull attr && attr != []) then (
      if (builtins.typeOf attr) == "set" then concatStringsSep " "
        (mapAttrsToList (name: value: mapConfig (key + "-" + name) value) attr) else
      if (builtins.typeOf attr) == "list" then concatMapStringsSep " " (mapConfig key) attr else
      if (builtins.typeOf attr) == "bool" then "--${key}=${boolToString attr}" else
      if (builtins.typeOf attr) == "string" then "--${key}='${attr}'" else
      "--${key}=${toString attr}")
      else "";
  
    configString = concatStringsSep " " (mapAttrsToList mapConfig allConfig);
  in
  {
    options.services.oauth2_proxy = {
  