anchor.diff:           "${domain} ${type} ${item} ${toString value}\n")
            limits);
   
  +  limitsType = with lib.types; listOf (submodule ({ ... }: {
  +    options = {
  +      domain = mkOption {
  +        description = "Username, groupname, or wildcard this limit applies to";
  +        example = "@wheel";
  +        type = str;
  +      };
  +
  +      type = mkOption {
  +        description = "Type of this limit";
  +        type = enum [ "-" "hard" "soft" ];
  +        default = "-";
  +      };
  +
  +      item = mkOption {
  +        description = "Item this limit applies to";
  +        type = enum [
  +          "core"
  +          "data"
  +          "fsize"
  +          "memlock"
  +          "nofile"
  +          "rss"
  +          "stack"
  +          "cpu"
  +          "nproc"
  +          "as"
  +          "maxlogins"
  +          "maxsyslogins"
  +          "priority"
  +          "locks"
  +          "sigpending"
  +          "msgqueue"
  +          "nice"
  +          "rtprio"
  +        ];
  +      };
  +
  +      value = mkOption {
  +        description = "Value of this limit";
  +        type = oneOf [ str int ];
  +      };
  +    };
  +  }));
  +
     motd = pkgs.writeText "motd" config.users.motd;
   
     makePAMService = name: service:
  
positive.code:       };
  
        limits = mkOption {
          description = ''
            Attribute set describing resource limits.  Defaults to the
            value of <option>security.pam.loginLimits</option>.
          '';
        };
  
  
negative.code: 
      security.pam.loginLimits = mkOption {
        default = [];
        type = limitsType;
        example =
          [ { domain = "ftp";
              type   = "hard";
  