anchor.diff:        description = ''
           DSS SSH private key file in the Dropbear format.
   
  -        WARNING: This key is contained insecurely in the global Nix store. Do NOT
  -        use your regular SSH host private keys for this purpose or you'll expose
  -        them to regular users!
  +        WARNING: Unless your bootloader supports initrd secrets, this key is
  +        contained insecurely in the global Nix store. Do NOT use your regular
  +        SSH host private keys for this purpose or you'll expose them to
  +        regular users!
         '';
       };
   
  
positive.code:       touch /var/log/lastlog
  
        mkdir -p /etc/dropbear
        ${optionalString (cfg.hostRSAKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key"}
        ${optionalString (cfg.hostDSSKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_dss_host_key /etc/dropbear/dropbear_dss_host_key"}
        ${optionalString (cfg.hostECDSAKey != null) "ln -s $extraUtils/etc/dropbear/dropbear_ecdsa_host_key /etc/dropbear/dropbear_ecdsa_host_key"}
  
        mkdir -p /root/.ssh
        ${concatStrings (map (key: ''
  
negative.code:       dropbear -s -j -k -E -m -p ${toString cfg.port}
      '';
  
      boot.initrd.secrets =
       (optionalAttrs (cfg.hostRSAKey != null) { "/etc/dropbear/dropbear_rsa_host_key" = cfg.hostRSAKey; }) //
       (optionalAttrs (cfg.hostDSSKey != null) { "/etc/dropbear/dropbear_dss_host_key" = cfg.hostDSSKey; }) //
       (optionalAttrs (cfg.hostECDSAKey != null) { "/etc/dropbear/dropbear_ecdsa_host_key" = cfg.hostECDSAKey; });
  
    };
  
  }
  