anchor.diff:            Whether to enable the Name Service Cache Daemon.
             Disabling this is strongly discouraged, as this effectively disables NSS Lookups
             from all non-glibc NSS modules, including the ones provided by systemd.
  +        '';
  +      };
  +
  +      user = mkOption {
  +        type = types.str;
  +        default = "nscd";
  +        description = ''
  +          User account under which nscd runs.
  +        '';
  +      };
  +
  +      group = mkOption {
  +        type = types.str;
  +        default = "nscd";
  +        description = ''
  +          User group under which nscd runs.
           '';
         };
   
  
positive.code:           config.environment.etc."nscd.conf".source
          ];
  
          # We use DynamicUser because in default configurations nscd doesn't
          # create any files that need to survive restarts. However, in some
          # configurations, nscd needs to be started as root; it will drop
          # privileges after all the NSS modules have read their configuration
          # files. So prefix the ExecStart command with "!" to prevent systemd
          # from dropping privileges early. See ExecStart in systemd.service(5).
          serviceConfig =
            { ExecStart = "!@${cfg.package}/bin/nscd nscd";
              Type = "forking";
              DynamicUser = true;
              RuntimeDirectory = "nscd";
              PIDFile = "/run/nscd/nscd.pid";
              Restart = "always";
  
negative.code:   config = mkIf cfg.enable {
      environment.etc."nscd.conf".text = cfg.config;
  
      users.users.${cfg.user} = {
        isSystemUser = true;
        group = cfg.group;
      };
  
      users.groups.${cfg.group} = {};
  
      systemd.services.nscd =
        { description = "Name Service Cache Daemon";
  
  