anchor.diff:  
     nixVersion = getVersion nix;
   
  -  isNix20 = versionAtLeast nixVersion "2.0pre";
     isNix23 = versionAtLeast nixVersion "2.3pre";
   
     makeNixBuildUser = nr:
  
positive.code:   nixbldUsers = map makeNixBuildUser (range 1 cfg.nrBuildUsers);
  
    nixConf =
      let
        # In Nix < 2.0, If we're using sandbox for builds, then provide
        # /bin/sh in the sandbox as a bind-mount to bash. This means we
        # also need to include the entire closure of bash. Nix >= 2.0
        # provides a /bin/sh by default.
        sh = pkgs.runtimeShell;
        binshDeps = pkgs.writeReferencesToFile sh;
      in
        pkgs.runCommand "nix.conf" { preferLocalBuild = true; extraOptions = cfg.extraOptions; } (''
          ${optionalString (!isNix20) ''
            extraPaths=$(for i in $(cat ${binshDeps}); do if test -d $i; then echo $i; fi; done)
          ''}
          cat > $out <<END
          # WARNING: this file is generated from the nix.* options in
          # your NixOS configuration, typically
          # /etc/nixos/configuration.nix.  Do not edit it!
          build-users-group = nixbld
          ${if isNix20 then "max-jobs" else "build-max-jobs"} = ${toString (cfg.maxJobs)}
          ${if isNix20 then "cores" else "build-cores"} = ${toString (cfg.buildCores)}
          ${if isNix20 then "sandbox" else "build-use-sandbox"} = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
          ${if isNix20 then "extra-sandbox-paths" else "build-sandbox-paths"} = ${toString cfg.sandboxPaths} ${optionalString (!isNix20) "/bin/sh=${sh} $(echo $extraPaths)"}
          ${if isNix20 then "substituters" else "binary-caches"} = ${toString cfg.binaryCaches}
          ${if isNix20 then "trusted-substituters" else "trusted-binary-caches"} = ${toString cfg.trustedBinaryCaches}
          ${if isNix20 then "trusted-public-keys" else "binary-cache-public-keys"} = ${toString cfg.binaryCachePublicKeys}
          auto-optimise-store = ${boolToString cfg.autoOptimiseStore}
          ${if isNix20 then ''
            require-sigs = ${if cfg.requireSignedBinaryCaches then "true" else "false"}
          '' else ''
            signed-binary-caches = ${if cfg.requireSignedBinaryCaches then "*" else ""}
          ''}
          trusted-users = ${toString cfg.trustedUsers}
          allowed-users = ${toString cfg.allowedUsers}
          ${optionalString (isNix20 && !cfg.distributedBuilds) ''
            builders =
          ''}
          system-features = ${toString cfg.systemFeatures}
  
negative.code: 
      systemd.services.nix-daemon =
        { path = [ nix pkgs.utillinux config.programs.ssh.package ]
            ++ optionals cfg.distributedBuilds [ pkgs.gzip ];
  
          environment = cfg.envVars
            // { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"; }
  