anchor.diff:               || cfg.openssh.authorizedKeys.keyFiles != [])
             ) cfg.users) ++ [
               config.security.googleOsLogin.enable
  -          ]);
  +          ];
           message = ''
             Neither the root account nor any wheel user has a password or SSH authorized key.
  -          You must set one to prevent being locked out of your system.'';
  +          You must set one to prevent being locked out of your system.
  +          If you really want to be locked out of your system, set users.allowNoPasswordLogin = true;
  +          However you are most probably better off by setting users.mutableUsers = true; and
  +          manually running passwd root to set the root password.
  +          '';
         }
       ] ++ flatten (flip mapAttrsToList cfg.users (name: user:
         [
  
positive.code:         home = "/root";
          shell = mkDefault cfg.defaultUserShell;
          group = "root";
        };
        nobody = {
          uid = ids.uids.nobody;
  
negative.code:       '';
      };
  
  
      users.allowNoPasswordLogin = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Disable checking that at least the <literal>root</literal> user or a user in the <literal>wheel</literal> group can log in using
          a password or an SSH key.
  
          WARNING: enabling this can lock you out of your system. Enable this only if you know what are you doing.
        '';
      };
    };
  
  
  