anchor.diff:    ldap = (config.users.ldap.enable && config.users.ldap.nsswitch);
     sssd = config.services.sssd.enable;
     resolved = config.services.resolved.enable;
  +  # only with nscd up and running we can load NSS modules that are not integrated in NSS
  +  canLoadExternalModules = config.services.nscd.enable;
   
     hostArray = [ "files" "mymachines" ]
       ++ optionals nssmdns [ "mdns_minimal [!UNAVAIL=return]" ]
  
positive.code:   options = {
  
      # NSS modules.  Hacky!
      system.nssModules = mkOption {
        type = types.listOf types.path;
        internal = true;
  
negative.code:   };
  
    config = {
      assertions = [
        {
          # generic catch if the NixOS module adding to nssModules does not prevent it with specific message.
          assertion = config.system.nssModules.path != "" -> canLoadExternalModules;
          message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled.";
        }
        {
          # resolved does not need to add to nssModules, therefore needs an extra assertion
          assertion = resolved -> canLoadExternalModules;
          message = "Loading systemd-resolved's nss-resolve NSS module requires nscd being enabled.";
        }
      ];
  
      # Name Service Switch configuration file.  Required by the C
      # library.  !!! Factor out the mdns stuff.  The avahi module
  