From 261e7d47d574199e7f423b64cbf82b6fb81059c5 Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Thu, 26 Feb 2026 23:01:30 +0100
Subject: [PATCH] lldap: set better default for enforceGroups

---
 modules/blocks/lldap.nix             | 2 +-
 modules/blocks/lldap/docs/default.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/blocks/lldap.nix b/modules/blocks/lldap.nix
index 9d66a6d..807e2a5 100644
--- a/modules/blocks/lldap.nix
+++ b/modules/blocks/lldap.nix
@@ -331,7 +331,7 @@ in
     enforceGroups = mkOption {
       description = "Remove groups not set declaratively.";
       type = types.bool;
-      default = true;
+      default = false;
     };
 
     dashboard = lib.mkOption {
diff --git a/modules/blocks/lldap/docs/default.md b/modules/blocks/lldap/docs/default.md
index c0b9755..3353f79 100644
--- a/modules/blocks/lldap/docs/default.md
+++ b/modules/blocks/lldap/docs/default.md
@@ -83,7 +83,7 @@ Also, all other groups will be deleted and only the "family" group will remain.
 Note that the `lldap_admin`, `lldap_password_manager` and `lldap_strict_readonly` groups, which are internal to LLDAP, will always exist.
 
 If you want existing groups not declared in the `shb.lldap.ensureGroups` to be deleted,
-set [`shb.lldap.enforceGroups`](#blocks-lldap-options-shb.lldap.enforceGroups) to `false`.
+set [`shb.lldap.enforceGroups`](#blocks-lldap-options-shb.lldap.enforceGroups) to `true`.
 
 ```nix
 {