anchor.diff:      v == "without-password" ||
       v == "forced-commands-only" ||
       v == "no";
  +
  +  hostKeyTypeNames = {
  +    dsa1024  = "dsa";
  +    rsa1024  = "rsa";
  +    ecdsa521 = "ecdsa";
  +  };
  +
  +  hostKeyTypeBits = {
  +    dsa1024  = 1024;
  +    rsa1024  = 1024;
  +    ecdsa521 = 521;
  +  };
  +
  +  hktn = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeNames;
  +  hktb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeBits;
   
     userOptions = {
       openssh.authorizedKeys = {
  
positive.code: 
          exec =
            ''
              ${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key \
                -f ${pkgs.writeText "sshd_config" cfg.extraConfig}
            '';
        };
  
negative.code: 
              mkdir -m 0755 -p /etc/ssh
  
              if ! test -f /etc/ssh/ssh_host_${hktn}_key; then
                  ${pkgs.openssh}/bin/ssh-keygen -t ${hktn} -b ${toString hktb} -f /etc/ssh/ssh_host_${hktn}_key -N ""
              fi
            '';
  
  