anchor.diff:  {pkgs, config, lib, ...}:
   
   let
  -
     inherit (lib) mkOption mkIf;
  -
  -  inherit (pkgs) heimdalFull;
  -
  +  cfg = config.services.kerberos_server;
     stateDir = "/var/heimdal";
   in
   
   {
  -
     ###### interface
  -
     options = {
  -
       services.kerberos_server = {
  -
         enable = mkOption {
           default = false;
           description = ''
  
positive.code:       };
  
      };
  
    };
  
  
    ###### implementation
  
    config = mkIf config.services.kerberos_server.enable {
  
      environment.systemPackages = [ heimdalFull ];
      systemd.services.kadmind = {
        description = "Kerberos Administration Daemon";
        script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
  
negative.code:       preStart = ''
          mkdir -m 0755 -p ${stateDir}
        '';
        script = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
      };
  
      systemd.services.kpasswdd = {
        description = "Kerberos Password Changing daemon";
        wantedBy = [ "multi-user.target" ];
        script = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
      };
    };
  }
  