anchor.diff:  in
   
   {
  +  imports = [
  +    (lib.mkRemovedOptionModule [ "services" "zabbixProxy" "extraConfig" ] "Use services.zabbixProxy.settings instead.")
  +  ];
  +
     # interface
   
     options = {
  
positive.code:   pgsql = config.services.postgresql;
    mysql = config.services.mysql;
  
    inherit (lib) mkDefault mkEnableOption mkIf mkOption;
    inherit (lib) attrValues concatMapStringsSep literalExample optional optionalAttrs optionalString types;
  
    user = "zabbix";
    group = "zabbix";
  
negative.code:       { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
          message = "a password cannot be specified if services.zabbixProxy.database.createLocally is set to true";
        }
      ];
  
      services.zabbixProxy.settings = mkMerge [
        {
          LogType = "console";
          ListenIP = cfg.listen.ip;
          ListenPort = cfg.listen.port;
          Server = cfg.server;
          # TODO: set to cfg.database.socket if database type is pgsql?
          DBHost = optionalString (cfg.database.createLocally != true) cfg.database.host;
          DBName = cfg.database.name;
          DBUser = cfg.database.user;
          SocketDir = runtimeDir;
          FpingLocation = "/run/wrappers/bin/fping";
          LoadModule = builtins.attrNames cfg.modules;
        }
        (mkIf (cfg.database.createLocally != true) { DBPort = cfg.database.port; })
        (mkIf (cfg.database.passwordFile != null) { Include = [ "${passwordFile}" ]; })
        (mkIf (mysqlLocal && cfg.database.socket != null) { DBSocket = cfg.database.socket; })
        (mkIf (cfg.modules != {}) { LoadModulePath = "${moduleEnv}/lib"; })
      ];
  
      networking.firewall = mkIf cfg.openFirewall {
  