anchor.diff:            concatMapStrings (machine:
               "${if machine.sshUser != null then "${machine.sshUser}@" else ""}${machine.hostName} "
               + (if machine.system != null then machine.system else concatStringsSep "," machine.systems)
  -            + " ${machine.sshKey} ${toString machine.maxJobs} "
  +            + " ${if machine.sshKey != null then machine.sshKey else "-"} ${toString machine.maxJobs} "
               + toString (machine.speedFactor)
               + " "
               + concatStringsSep "," (machine.mandatoryFeatures ++ machine.supportedFeatures)
  
positive.code:               default = 1;
                description = ''
                  The number of concurrent jobs the build machine supports. The
                  build machine will enforce its own limits but this allows hydra
                  to schedule better since there is no work-stealing between build
                  machines.
                '';
  
negative.code:       };
  
        buildMachines = mkOption {
          type = types.listOf (types.submodule ({
            options = {
              hostName = mkOption {
                type = types.str;
                example = "nixbuilder.example.org";
                description = ''
                  The hostname of the build machine.
                '';
              };
              system = mkOption {
                type = types.nullOr types.str;
                default = null;
                example = "x86_64-linux";
                description = ''
                  The system type the build machine can execute derivations on.
                  Either this attribute or <varname>systems</varname> must be
                  present, where <varname>system</varname> takes precedence if
                  both are set.
                '';
              };
              systems = mkOption {
                type = types.listOf types.str;
                default = [];
                example = [ "x86_64-linux" "aarch64-linux" ];
                description = ''
                  The system types the build machine can execute derivations on.
                  Either this attribute or <varname>system</varname> must be
                  present, where <varname>system</varname> takes precedence if
                  both are set.
                '';
              };
              sshUser = mkOption {
                type = types.nullOr types.str;
                default = null;
                example = "builder";
                description = ''
                  The username to log in as on the remote host. This user must be
                  able to log in and run nix commands non-interactively. It must
                  also be privileged to build derivations, so must be included in
                  <option>nix.trustedUsers</option>.
                '';
              };
              sshKey = mkOption {
                type = types.nullOr types.str;
                default = null;
                example = "/root/.ssh/id_buildhost_builduser";
                description = ''
                  The path to the SSH private key with which to authenticate on
                  the build machine. The private key must not have a passphrase.
                  If null, the building user (root on NixOS machines) must have an
                  appropriate ssh configuration to log in non-interactively.
  
                  Note that for security reasons, this path must point to a file
                  in the local filesystem, *not* to the nix store.
                '';
              };
              maxJobs = mkOption {
  