anchor.diff:  
         UsePAM yes
   
  -      ${ pkgs.lib.concatMapStrings (port : ''Port ${toString port}
  +      ${ concatMapStrings (port : ''Port ${toString port}
                                              '') cfg.ports}
   
         ${if cfg.forwardX11 then "
  
positive.code: 
    config = mkIf config.services.sshd.enable {
  
      users.extraUsers = pkgs.lib.singleton
        { name = "sshd";
          uid = config.ids.uids.sshd;
          description = "SSH privilege separation user";
          home = "/var/empty";
        };
  
      jobs.sshd = {
  
negative.code: { config, pkgs, ... }:
  
  with pkgs.lib;
  
  let
  
    inherit (pkgs) openssh;
  
    cfg = config.services.sshd;
  