Hm, I just tested passing -d "acl trace" and slapd said

unrecognized log level "acl trace"

Where is it documented that it should be able to take string values like that, like the nixos module example says?

Ah, I think the CLI option only takes one word, but it can be passed multiple times: -d acl -d trace. Perhaps the multiple loglevels can be set at once in the config file.

Then to really make the loglevel setting correct, either we should make it a list of strings, or set the loglevel option in the config file rather than on the command-line.

Where is it documented that it should be able to take string values like that, like the nixos module example says?

man slapd, man slapd.conf.

After reading a bit more, I think the point of the original "-d 0" argument in the nixos module was just to prevent slapd from forking. slapd loglevels are bitfields, so the -d 0 is really a NOP wrt. logging.

Btw, there's lib.escapeShellArg you could've used instead, which also escapes ' properly