---
Function {
 argument: None,
 arguments: FunctionArguments {
  arguments: [
   FunctionArgument {
    identifier: "pkgs",
    default: None,
   },
   FunctionArgument {
    identifier: "lib",
    default: None,
   },
   FunctionArgument {
    identifier: "config",
    default: None,
   },
  ],
  ellipsis: true,
 },
 definition: With {
  expression: Variable {
   identifier: "lib",
   position: (3, 6),
  },
  target: LetIn {
   bindings: [
    KeyValue(
     AttributePath {
      attributes: [
       Raw {
        content: "cfg",
        position: (6, 3),
       },
      ],
     },
     PropertyAccess {
      expression: Variable {
       identifier: "config",
       position: (6, 9),
      },
      attribute_path: AttributePath {
       attributes: [
        Raw {
         content: "security",
         position: (6, 16),
        },
        Raw {
         content: "duosec",
         position: (6, 25),
        },
       ],
      },
      default: None,
     },
    ),
    KeyValue(
     AttributePath {
      attributes: [
       Raw {
        content: "boolToStr",
        position: (8, 3),
       },
      ],
     },
     Function {
      argument: Some(
       "b",
      ),
      arguments: FunctionArguments {
       arguments: [],
       ellipsis: false,
      },
      definition: IfThenElse {
       predicate: Variable {
        identifier: "b",
        position: (8, 21),
       },
       then: String {
        parts: [
         Raw {
          content: "yes",
          position: (8, 29),
         },
        ],
       },
       else_: String {
        parts: [
         Raw {
          content: "no",
          position: (8, 40),
         },
        ],
       },
       position: (8, 18),
      },
      position: (8, 15),
     },
    ),
    KeyValue(
     AttributePath {
      attributes: [
       Raw {
        content: "configFilePam",
        position: (10, 3),
       },
      ],
     },
     String {
      parts: [
       Raw {
        content: "[duo]\nikey=",
        position: (11, 1),
       },
       Expression {
        expression: PropertyAccess {
         expression: Variable {
          identifier: "cfg",
          position: (12, 12),
         },
         attribute_path: AttributePath {
          attributes: [
           Raw {
            content: "integrationKey",
            position: (12, 16),
           },
          ],
         },
         default: None,
        },
       },
       Raw {
        content: "\nhost=",
        position: (12, 31),
       },
       Expression {
        expression: PropertyAccess {
         expression: Variable {
          identifier: "cfg",
          position: (13, 12),
         },
         attribute_path: AttributePath {
          attributes: [
           Raw {
            content: "host",
            position: (13, 16),
           },
          ],
         },
         default: None,
        },
       },
       Raw {
        content: "\n",
        position: (13, 21),
       },
       Expression {
        expression: FunctionApplication {
         function: Variable {
          identifier: "optionalString",
          position: (14, 7),
         },
         arguments: [
          BinaryOperation {
           operator: NotEqualTo,
           operands: [
            PropertyAccess {
             expression: Variable {
              identifier: "cfg",
              position: (14, 23),
             },
             attribute_path: AttributePath {
              attributes: [
               Raw {
                content: "groups",
                position: (14, 27),
               },
              ],
             },
             default: None,
            },
            String {
             parts: [],
            },
           ],
           position: (14, 34),
          },
          BinaryOperation {
           operator: Addition,
           operands: [
            String {
             parts: [
              Raw {
               content: "groups=",
               position: (14, 43),
              },
             ],
            },
            PropertyAccess {
             expression: Variable {
              identifier: "cfg",
              position: (14, 52),
             },
             attribute_path: AttributePath {
              attributes: [
               Raw {
                content: "groups",
                position: (14, 56),
               },
              ],
             },
             default: None,
            },
           ],
           position: (14, 51),
          },
         ],
        },
       },
       Raw {
        content: "\nfailmode=",
        position: (14, 64),
       },
       Expression {
        expression: PropertyAccess {
         expression: Variable {
          identifier: "cfg",
          position: (15, 16),
         },
         attribute_path: AttributePath {
          attributes: [
           Raw {
            content: "failmode",
            position: (15, 20),
           },
          ],
         },
         default: None,
        },
       },
       Raw {
        content: "\npushinfo=",
        position: (15, 29),
       },
       Expression {
        expression: FunctionApplication {
         function: Variable {
          identifier: "boolToStr",
          position: (16, 16),
         },
         arguments: [
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (16, 26),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "pushinfo",
              position: (16, 30),
             },
            ],
           },
           default: None,
          },
         ],
        },
       },
       Raw {
        content: "\nautopush=",
        position: (16, 39),
       },
       Expression {
        expression: FunctionApplication {
         function: Variable {
          identifier: "boolToStr",
          position: (17, 16),
         },
         arguments: [
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (17, 26),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "autopush",
              position: (17, 30),
             },
            ],
           },
           default: None,
          },
         ],
        },
       },
       Raw {
        content: "\nprompts=",
        position: (17, 39),
       },
       Expression {
        expression: FunctionApplication {
         function: Variable {
          identifier: "toString",
          position: (18, 15),
         },
         arguments: [
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (18, 24),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "prompts",
              position: (18, 28),
             },
            ],
           },
           default: None,
          },
         ],
        },
       },
       Raw {
        content: "\nfallback_local_ip=",
        position: (18, 36),
       },
       Expression {
        expression: FunctionApplication {
         function: Variable {
          identifier: "boolToStr",
          position: (19, 25),
         },
         arguments: [
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (19, 35),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "fallbackLocalIP",
              position: (19, 39),
             },
            ],
           },
           default: None,
          },
         ],
        },
       },
       Raw {
        content: "\n",
        position: (19, 55),
       },
      ],
     },
    ),
    KeyValue(
     AttributePath {
      attributes: [
       Raw {
        content: "configFileLogin",
        position: (22, 3),
       },
      ],
     },
     BinaryOperation {
      operator: Addition,
      operands: [
       Variable {
        identifier: "configFilePam",
        position: (22, 21),
       },
       String {
        parts: [
         Raw {
          content: "motd=",
          position: (23, 1),
         },
         Expression {
          expression: FunctionApplication {
           function: Variable {
            identifier: "boolToStr",
            position: (23, 12),
           },
           arguments: [
            PropertyAccess {
             expression: Variable {
              identifier: "cfg",
              position: (23, 22),
             },
             attribute_path: AttributePath {
              attributes: [
               Raw {
                content: "motd",
                position: (23, 26),
               },
              ],
             },
             default: None,
            },
           ],
          },
         },
         Raw {
          content: "\naccept_env_factor=",
          position: (23, 31),
         },
         Expression {
          expression: FunctionApplication {
           function: Variable {
            identifier: "boolToStr",
            position: (24, 25),
           },
           arguments: [
            PropertyAccess {
             expression: Variable {
              identifier: "cfg",
              position: (24, 35),
             },
             attribute_path: AttributePath {
              attributes: [
               Raw {
                content: "acceptEnvFactor",
                position: (24, 39),
               },
              ],
             },
             default: None,
            },
           ],
          },
         },
         Raw {
          content: "\n",
          position: (24, 55),
         },
        ],
       },
      ],
      position: (22, 35),
     },
    ),
   ],
   target: Map {
    bindings: [
     KeyValue(
      AttributePath {
       attributes: [
        Raw {
         content: "imports",
         position: (28, 3),
        },
       ],
      },
      List {
       elements: [
        FunctionApplication {
         function: Variable {
          identifier: "mkRenamedOptionModule",
          position: (29, 6),
         },
         arguments: [
          List {
           elements: [
            String {
             parts: [
              Raw {
               content: "security",
               position: (29, 31),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "duosec",
               position: (29, 42),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "group",
               position: (29, 51),
              },
             ],
            },
           ],
           position: (29, 28),
          },
          List {
           elements: [
            String {
             parts: [
              Raw {
               content: "security",
               position: (29, 63),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "duosec",
               position: (29, 74),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "groups",
               position: (29, 83),
              },
             ],
            },
           ],
           position: (29, 60),
          },
         ],
        },
        FunctionApplication {
         function: Variable {
          identifier: "mkRenamedOptionModule",
          position: (30, 6),
         },
         arguments: [
          List {
           elements: [
            String {
             parts: [
              Raw {
               content: "security",
               position: (30, 31),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "duosec",
               position: (30, 42),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "ikey",
               position: (30, 51),
              },
             ],
            },
           ],
           position: (30, 28),
          },
          List {
           elements: [
            String {
             parts: [
              Raw {
               content: "security",
               position: (30, 62),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "duosec",
               position: (30, 73),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "integrationKey",
               position: (30, 82),
              },
             ],
            },
           ],
           position: (30, 59),
          },
         ],
        },
        FunctionApplication {
         function: Variable {
          identifier: "mkRemovedOptionModule",
          position: (31, 6),
         },
         arguments: [
          List {
           elements: [
            String {
             parts: [
              Raw {
               content: "security",
               position: (31, 31),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "duosec",
               position: (31, 42),
              },
             ],
            },
            String {
             parts: [
              Raw {
               content: "skey",
               position: (31, 51),
              },
             ],
            },
           ],
           position: (31, 28),
          },
          String {
           parts: [
            Raw {
             content: "The insecure security.duosec.skey option has been replaced by a new security.duosec.secretKeyFile option. Use this new option to store a secure copy of your key instead.",
             position: (31, 60),
            },
           ],
          },
         ],
        },
       ],
       position: (28, 13),
      },
     ),
     KeyValue(
      AttributePath {
       attributes: [
        Raw {
         content: "options",
         position: (34, 3),
        },
       ],
      },
      Map {
       bindings: [
        KeyValue(
         AttributePath {
          attributes: [
           Raw {
            content: "security",
            position: (35, 5),
           },
           Raw {
            content: "duosec",
            position: (35, 14),
           },
          ],
         },
         Map {
          bindings: [
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "ssh",
               position: (36, 7),
              },
              Raw {
               content: "enable",
               position: (36, 11),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (36, 20),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (37, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (37, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (37, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (38, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (38, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (39, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "If enabled, protect SSH logins with Duo Security.",
                    position: (39, 24),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (36, 29),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "pam",
               position: (42, 7),
              },
              Raw {
               content: "enable",
               position: (42, 11),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (42, 20),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (43, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (43, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (43, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (44, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (44, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (45, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "If enabled, protect logins with Duo Security using PAM support.",
                    position: (45, 24),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (42, 29),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "integrationKey",
               position: (48, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (48, 24),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (49, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (49, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "str",
                     position: (49, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (50, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Integration key.",
                    position: (50, 24),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (48, 33),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "secretKeyFile",
               position: (53, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (53, 23),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (54, 9),
                   },
                  ],
                 },
                 FunctionApplication {
                  function: PropertyAccess {
                   expression: Variable {
                    identifier: "types",
                    position: (54, 16),
                   },
                   attribute_path: AttributePath {
                    attributes: [
                     Raw {
                      content: "nullOr",
                      position: (54, 22),
                     },
                    ],
                   },
                   default: None,
                  },
                  arguments: [
                   PropertyAccess {
                    expression: Variable {
                     identifier: "types",
                     position: (54, 29),
                    },
                    attribute_path: AttributePath {
                     attributes: [
                      Raw {
                       content: "path",
                       position: (54, 35),
                      },
                     ],
                    },
                    default: None,
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (55, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "null",
                  position: (55, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (56, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "A file containing your secret key. The security of your Duo application is tied to the security of your secret key.\n",
                    position: (57, 1),
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "example",
                    position: (59, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "/run/keys/duo-skey",
                    position: (59, 20),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (53, 32),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "host",
               position: (62, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (62, 14),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (63, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (63, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "str",
                     position: (63, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (64, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Duo API hostname.",
                    position: (64, 24),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (62, 23),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "groups",
               position: (67, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (67, 16),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (68, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (68, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "str",
                     position: (68, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (69, 9),
                   },
                  ],
                 },
                 String {
                  parts: [],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "example",
                    position: (70, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "users,!wheel,!*admin guests",
                    position: (70, 20),
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (71, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "If specified, Duo authentication is required only for users\nwhose primary group or supplementary group list matches one\nof the space-separated pattern lists. Refer to\n<link xlink:href=\"https://duo.com/docs/duounix\"/> for details.\n",
                    position: (72, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (67, 25),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "failmode",
               position: (79, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (79, 18),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (80, 9),
                   },
                  ],
                 },
                 FunctionApplication {
                  function: PropertyAccess {
                   expression: Variable {
                    identifier: "types",
                    position: (80, 16),
                   },
                   attribute_path: AttributePath {
                    attributes: [
                     Raw {
                      content: "enum",
                      position: (80, 22),
                     },
                    ],
                   },
                   default: None,
                  },
                  arguments: [
                   List {
                    elements: [
                     String {
                      parts: [
                       Raw {
                        content: "safe",
                        position: (80, 30),
                       },
                      ],
                     },
                     String {
                      parts: [
                       Raw {
                        content: "secure",
                        position: (80, 37),
                       },
                      ],
                     },
                    ],
                    position: (80, 27),
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (81, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "safe",
                    position: (81, 20),
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (82, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "On service or configuration errors that prevent Duo\nauthentication, fail \"safe\" (allow access) or \"secure\" (deny\naccess). The default is \"safe\".\n",
                    position: (83, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (79, 27),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "pushinfo",
               position: (89, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (89, 18),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (90, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (90, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (90, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (91, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (91, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (92, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Include information such as the command to be executed in\nthe Duo Push message.\n",
                    position: (93, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (89, 27),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "autopush",
               position: (98, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (98, 18),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (99, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (99, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (99, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (100, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (100, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (101, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "If <literal>true</literal>, Duo Unix will automatically send\na push login request to the user’s phone, falling back on a\nphone call if push is unavailable. If\n<literal>false</literal>, the user will be prompted to\nchoose an authentication method. When configured with\n<literal>autopush = yes</literal>, we recommend setting\n<literal>prompts = 1</literal>.\n",
                    position: (102, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (98, 27),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "motd",
               position: (112, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (112, 14),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (113, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (113, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (113, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (114, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (114, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (115, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Print the contents of <literal>/etc/motd</literal> to screen\nafter a successful login.\n",
                    position: (116, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (112, 23),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "prompts",
               position: (121, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (121, 17),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (122, 9),
                   },
                  ],
                 },
                 FunctionApplication {
                  function: PropertyAccess {
                   expression: Variable {
                    identifier: "types",
                    position: (122, 16),
                   },
                   attribute_path: AttributePath {
                    attributes: [
                     Raw {
                      content: "enum",
                      position: (122, 22),
                     },
                    ],
                   },
                   default: None,
                  },
                  arguments: [
                   List {
                    elements: [
                     Int {
                      value: 1,
                      position: (122, 29),
                     },
                     Int {
                      value: 2,
                      position: (122, 31),
                     },
                     Int {
                      value: 3,
                      position: (122, 33),
                     },
                    ],
                    position: (122, 27),
                   },
                  ],
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (123, 9),
                   },
                  ],
                 },
                 Int {
                  value: 3,
                  position: (123, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (124, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "If a user fails to authenticate with a second factor, Duo\nUnix will prompt the user to authenticate again. This option\nsets the maximum number of prompts that Duo Unix will\ndisplay before denying access. Must be 1, 2, or 3. Default\nis 3.\n\nFor example, when <literal>prompts = 1</literal>, the user\nwill have to successfully authenticate on the first prompt,\nwhereas if <literal>prompts = 2</literal>, if the user\nenters incorrect information at the initial prompt, he/she\nwill be prompted to authenticate again.\n\nWhen configured with <literal>autopush = true</literal>, we\nrecommend setting <literal>prompts = 1</literal>.\n",
                    position: (125, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (121, 26),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "acceptEnvFactor",
               position: (142, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (142, 25),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (143, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (143, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (143, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (144, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (144, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (145, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Look for factor selection or passcode in the\n<literal>$DUO_PASSCODE</literal> environment variable before\nprompting the user for input.\n\nWhen $DUO_PASSCODE is non-empty, it will override\nautopush. The SSH client will need SendEnv DUO_PASSCODE in\nits configuration, and the SSH server will similarly need\nAcceptEnv DUO_PASSCODE.\n",
                    position: (146, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (142, 34),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "fallbackLocalIP",
               position: (157, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (157, 25),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (158, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (158, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (158, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (159, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (159, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (160, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "Duo Unix reports the IP address of the authorizing user, for\nthe purposes of authorization and whitelisting. If Duo Unix\ncannot detect the IP address of the client, setting\n<literal>fallbackLocalIP = yes</literal> will cause Duo Unix\nto send the IP address of the server it is running on.\n\nIf you are using IP whitelisting, enabling this option could\ncause unauthorized logins if the local IP is listed in the\nwhitelist.\n",
                    position: (161, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (157, 34),
              },
             ],
            },
           ),
           KeyValue(
            AttributePath {
             attributes: [
              Raw {
               content: "allowTcpForwarding",
               position: (173, 7),
              },
             ],
            },
            FunctionApplication {
             function: Variable {
              identifier: "mkOption",
              position: (173, 28),
             },
             arguments: [
              Map {
               bindings: [
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "type",
                    position: (174, 9),
                   },
                  ],
                 },
                 PropertyAccess {
                  expression: Variable {
                   identifier: "types",
                   position: (174, 16),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "bool",
                     position: (174, 22),
                    },
                   ],
                  },
                  default: None,
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "default",
                    position: (175, 9),
                   },
                  ],
                 },
                 Variable {
                  identifier: "false",
                  position: (175, 19),
                 },
                ),
                KeyValue(
                 AttributePath {
                  attributes: [
                   Raw {
                    content: "description",
                    position: (176, 9),
                   },
                  ],
                 },
                 String {
                  parts: [
                   Raw {
                    content: "By default, when SSH forwarding, enabling Duo Security will\ndisable TCP forwarding. By enabling this, you potentially\nundermine some of the SSH based login security. Note this is\nnot needed if you use PAM.\n",
                    position: (177, 1),
                   },
                  ],
                 },
                ),
               ],
               recursive: false,
               position: (173, 37),
              },
             ],
            },
           ),
          ],
          recursive: false,
          position: (35, 23),
         },
        ),
       ],
       recursive: false,
       position: (34, 13),
      },
     ),
     KeyValue(
      AttributePath {
       attributes: [
        Raw {
         content: "config",
         position: (186, 3),
        },
       ],
      },
      FunctionApplication {
       function: Variable {
        identifier: "mkIf",
        position: (186, 12),
       },
       arguments: [
        BinaryOperation {
         operator: LogicalOr,
         operands: [
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (186, 18),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "ssh",
              position: (186, 22),
             },
             Raw {
              content: "enable",
              position: (186, 26),
             },
            ],
           },
           default: None,
          },
          PropertyAccess {
           expression: Variable {
            identifier: "cfg",
            position: (186, 36),
           },
           attribute_path: AttributePath {
            attributes: [
             Raw {
              content: "pam",
              position: (186, 40),
             },
             Raw {
              content: "enable",
              position: (186, 44),
             },
            ],
           },
           default: None,
          },
         ],
         position: (186, 33),
        },
        Map {
         bindings: [
          KeyValue(
           AttributePath {
            attributes: [
             Raw {
              content: "environment",
              position: (187, 5),
             },
             Raw {
              content: "systemPackages",
              position: (187, 17),
             },
            ],
           },
           List {
            elements: [
             PropertyAccess {
              expression: Variable {
               identifier: "pkgs",
               position: (187, 36),
              },
              attribute_path: AttributePath {
               attributes: [
                Raw {
                 content: "duo-unix",
                 position: (187, 41),
                },
               ],
              },
              default: None,
             },
            ],
            position: (187, 34),
           },
          ),
          KeyValue(
           AttributePath {
            attributes: [
             Raw {
              content: "security",
              position: (189, 5),
             },
             Raw {
              content: "wrappers",
              position: (189, 14),
             },
             Raw {
              content: "login_duo",
              position: (189, 23),
             },
            ],
           },
           Map {
            bindings: [
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "setuid",
                 position: (190, 9),
                },
               ],
              },
              Variable {
               identifier: "true",
               position: (190, 18),
              },
             ),
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "owner",
                 position: (191, 9),
                },
               ],
              },
              String {
               parts: [
                Raw {
                 content: "root",
                 position: (191, 18),
                },
               ],
              },
             ),
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "group",
                 position: (192, 9),
                },
               ],
              },
              String {
               parts: [
                Raw {
                 content: "root",
                 position: (192, 18),
                },
               ],
              },
             ),
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "source",
                 position: (193, 9),
                },
               ],
              },
              String {
               parts: [
                Expression {
                 expression: PropertyAccess {
                  expression: Variable {
                   identifier: "pkgs",
                   position: (193, 21),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "duo-unix",
                     position: (193, 26),
                    },
                    Raw {
                     content: "out",
                     position: (193, 35),
                    },
                   ],
                  },
                  default: None,
                 },
                },
                Raw {
                 content: "/bin/login_duo",
                 position: (193, 39),
                },
               ],
              },
             ),
            ],
            recursive: false,
            position: (190, 7),
           },
          ),
          KeyValue(
           AttributePath {
            attributes: [
             Raw {
              content: "system",
              position: (196, 5),
             },
             Raw {
              content: "activationScripts",
              position: (196, 12),
             },
            ],
           },
           Map {
            bindings: [
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "login_duo",
                 position: (197, 7),
                },
               ],
              },
              FunctionApplication {
               function: Variable {
                identifier: "mkIf",
                position: (197, 19),
               },
               arguments: [
                PropertyAccess {
                 expression: Variable {
                  identifier: "cfg",
                  position: (197, 24),
                 },
                 attribute_path: AttributePath {
                  attributes: [
                   Raw {
                    content: "ssh",
                    position: (197, 28),
                   },
                   Raw {
                    content: "enable",
                    position: (197, 32),
                   },
                  ],
                 },
                 default: None,
                },
                String {
                 parts: [
                  Raw {
                   content: "if test -f \"",
                   position: (198, 1),
                  },
                  Expression {
                   expression: PropertyAccess {
                    expression: Variable {
                     identifier: "cfg",
                     position: (198, 23),
                    },
                    attribute_path: AttributePath {
                     attributes: [
                      Raw {
                       content: "secretKeyFile",
                       position: (198, 27),
                      },
                     ],
                    },
                    default: None,
                   },
                  },
                  Raw {
                   content: "\"; then\n  mkdir -m 0755 -p /etc/duo\n\n  umask 0077\n  conf=\"$(mktemp)\"\n  {\n    cat ",
                   position: (198, 41),
                  },
                  Expression {
                   expression: FunctionApplication {
                    function: PropertyAccess {
                     expression: Variable {
                      identifier: "pkgs",
                      position: (204, 19),
                     },
                     attribute_path: AttributePath {
                      attributes: [
                       Raw {
                        content: "writeText",
                        position: (204, 24),
                       },
                      ],
                     },
                     default: None,
                    },
                    arguments: [
                     String {
                      parts: [
                       Raw {
                        content: "login_duo.conf",
                        position: (204, 35),
                       },
                      ],
                     },
                     Variable {
                      identifier: "configFileLogin",
                      position: (204, 51),
                     },
                    ],
                   },
                  },
                  Raw {
                   content: "\n    printf 'skey = %s\\n' \"$(cat ",
                   position: (204, 67),
                  },
                  Expression {
                   expression: PropertyAccess {
                    expression: Variable {
                     identifier: "cfg",
                     position: (205, 43),
                    },
                    attribute_path: AttributePath {
                     attributes: [
                      Raw {
                       content: "secretKeyFile",
                       position: (205, 47),
                      },
                     ],
                    },
                    default: None,
                   },
                  },
                  Raw {
                   content: ")\"\n  } >\"$conf\"\n\n  chown sshd \"$conf\"\n  mv -fT \"$conf\" /etc/duo/login_duo.conf\nfi\n",
                   position: (205, 61),
                  },
                 ],
                },
               ],
              },
             ),
             KeyValue(
              AttributePath {
               attributes: [
                Raw {
                 content: "pam_duo",
                 position: (212, 7),
                },
               ],
              },
              FunctionApplication {
               function: Variable {
                identifier: "mkIf",
                position: (212, 17),
               },
               arguments: [
                PropertyAccess {
                 expression: Variable {
                  identifier: "cfg",
                  position: (212, 22),
                 },
                 attribute_path: AttributePath {
                  attributes: [
                   Raw {
                    content: "pam",
                    position: (212, 26),
                   },
                   Raw {
                    content: "enable",
                    position: (212, 30),
                   },
                  ],
                 },
                 default: None,
                },
                String {
                 parts: [
                  Raw {
                   content: "if test -f \"",
                   position: (213, 1),
                  },
                  Expression {
                   expression: PropertyAccess {
                    expression: Variable {
                     identifier: "cfg",
                     position: (213, 23),
                    },
                    attribute_path: AttributePath {
                     attributes: [
                      Raw {
                       content: "secretKeyFile",
                       position: (213, 27),
                      },
                     ],
                    },
                    default: None,
                   },
                  },
                  Raw {
                   content: "\"; then\n  mkdir -m 0755 -p /etc/duo\n\n  umask 0077\n  conf=\"$(mktemp)\"\n  {\n    cat ",
                   position: (213, 41),
                  },
                  Expression {
                   expression: FunctionApplication {
                    function: PropertyAccess {
                     expression: Variable {
                      identifier: "pkgs",
                      position: (219, 19),
                     },
                     attribute_path: AttributePath {
                      attributes: [
                       Raw {
                        content: "writeText",
                        position: (219, 24),
                       },
                      ],
                     },
                     default: None,
                    },
                    arguments: [
                     String {
                      parts: [
                       Raw {
                        content: "login_duo.conf",
                        position: (219, 35),
                       },
                      ],
                     },
                     Variable {
                      identifier: "configFilePam",
                      position: (219, 51),
                     },
                    ],
                   },
                  },
                  Raw {
                   content: "\n    printf 'skey = %s\\n' \"$(cat ",
                   position: (219, 65),
                  },
                  Expression {
                   expression: PropertyAccess {
                    expression: Variable {
                     identifier: "cfg",
                     position: (220, 43),
                    },
                    attribute_path: AttributePath {
                     attributes: [
                      Raw {
                       content: "secretKeyFile",
                       position: (220, 47),
                      },
                     ],
                    },
                    default: None,
                   },
                  },
                  Raw {
                   content: ")\"\n  } >\"$conf\"\n\n  mv -fT \"$conf\" /etc/duo/pam_duo.conf\nfi\n",
                   position: (220, 61),
                  },
                 ],
                },
               ],
              },
             ),
            ],
            recursive: false,
            position: (196, 32),
           },
          ),
          KeyValue(
           AttributePath {
            attributes: [
             Raw {
              content: "services",
              position: (230, 5),
             },
             Raw {
              content: "openssh",
              position: (230, 14),
             },
             Raw {
              content: "extraConfig",
              position: (230, 22),
             },
            ],
           },
           FunctionApplication {
            function: Variable {
             identifier: "mkIf",
             position: (230, 36),
            },
            arguments: [
             BinaryOperation {
              operator: LogicalOr,
              operands: [
               PropertyAccess {
                expression: Variable {
                 identifier: "cfg",
                 position: (230, 42),
                },
                attribute_path: AttributePath {
                 attributes: [
                  Raw {
                   content: "ssh",
                   position: (230, 46),
                  },
                  Raw {
                   content: "enable",
                   position: (230, 50),
                  },
                 ],
                },
                default: None,
               },
               PropertyAccess {
                expression: Variable {
                 identifier: "cfg",
                 position: (230, 60),
                },
                attribute_path: AttributePath {
                 attributes: [
                  Raw {
                   content: "pam",
                   position: (230, 64),
                  },
                  Raw {
                   content: "enable",
                   position: (230, 68),
                  },
                 ],
                },
                default: None,
               },
              ],
              position: (230, 57),
             },
             IfThenElse {
              predicate: PropertyAccess {
               expression: Variable {
                identifier: "cfg",
                position: (231, 8),
               },
               attribute_path: AttributePath {
                attributes: [
                 Raw {
                  content: "pam",
                  position: (231, 12),
                 },
                 Raw {
                  content: "enable",
                  position: (231, 16),
                 },
                ],
               },
               default: None,
              },
              then: String {
               parts: [
                Raw {
                 content: "UseDNS no",
                 position: (231, 29),
                },
               ],
              },
              else_: String {
               parts: [
                Raw {
                 content: "# Duo Security configuration\nForceCommand ",
                 position: (232, 1),
                },
                Expression {
                 expression: PropertyAccess {
                  expression: Variable {
                   identifier: "config",
                   position: (233, 22),
                  },
                  attribute_path: AttributePath {
                   attributes: [
                    Raw {
                     content: "security",
                     position: (233, 29),
                    },
                    Raw {
                     content: "wrapperDir",
                     position: (233, 38),
                    },
                   ],
                  },
                  default: None,
                 },
                },
                Raw {
                 content: "/login_duo\nPermitTunnel no\n",
                 position: (233, 49),
                },
                Expression {
                 expression: FunctionApplication {
                  function: Variable {
                   identifier: "optionalString",
                   position: (235, 9),
                  },
                  arguments: [
                   UnaryOperation {
                    operator: Not,
                    operand: PropertyAccess {
                     expression: Variable {
                      identifier: "cfg",
                      position: (235, 26),
                     },
                     attribute_path: AttributePath {
                      attributes: [
                       Raw {
                        content: "allowTcpForwarding",
                        position: (235, 30),
                       },
                      ],
                     },
                     default: None,
                    },
                    position: (235, 25),
                   },
                   String {
                    parts: [
                     Raw {
                      content: "AllowTcpForwarding no\n",
                      position: (236, 1),
                     },
                    ],
                   },
                  ],
                 },
                },
                Raw {
                 content: "\n",
                 position: (237, 10),
                },
               ],
              },
              position: (231, 5),
             },
            ],
           },
          ),
         ],
         recursive: false,
         position: (186, 52),
        },
       ],
      },
     ),
    ],
    recursive: false,
    position: (27, 1),
   },
   position: (5, 1),
  },
  position: (3, 1),
 },
 position: (1, 1),
}