anchor.diff:      v == "without-password" ||
       v == "forced-commands-only" ||
       v == "no";
  -
  -  hostKeyTypeNames = {
  -    dsa1024  = "dsa"; # DSA has a key size limitation due to standards
  -    rsa3072  = "rsa";
  -    ecdsa521 = "ecdsa";
  -  };
  -
  -  hostKeyTypeBits = {
  -    dsa1024  = 1024; # =80 bits of security
  -    rsa3072  = 3072; # =128 bits of security
  -    ecdsa521 = 521;  # =256 bits of security
  -  };
  -
  -  # equivalent to 112 bit of security strength. Anything below this is very unsafe.
  -  hostKeyTypeSafeBits = {
  -    dsa1024  = 2048;
  -    rsa3072  = 2048;
  -    ecdsa521 = 255;
  -  };
  -
  -  hktn = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeNames;
  -  hktb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeBits;
  -  hktsb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeSafeBits;
   
     knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
   
  
positive.code:         '';
        };
  
        hostKeyType = mkOption {
          default = "dsa1024";
          description = ''
            Type of host key to generate (dsa1024/rsa3072/ecdsa521), if
            the file specified by <literal>hostKeyPath</literal> does not
            exist when the service starts.
          '';
        };
  
        hostKeyPath = mkOption {
          default = "/etc/ssh/ssh_host_${hktn}_key";
          description = ''
            Path to the server's private key. If there is no key file
            on this path, it will be generated when the service is
            started for the first time. Otherwise, the ssh daemon will
            use the specified key directly in-place.
          '';
        };
  
  
negative.code:           ''
              mkdir -m 0755 -p /etc/ssh
  
              ${flip concatMapStrings cfg.hostKeys (k: ''
                if ! [ -f "${k.path}" ]; then
                    ssh-keygen -t "${k.type}" -b "${toString k.bits}" -f "${k.path}" -N ""
                fi
              '')}
            '';
  
          serviceConfig =
            { ExecStart =
                "${pkgs.openssh}/sbin/sshd " +
                "-f ${pkgs.writeText "sshd_config" cfg.extraConfig}";
              Restart = "always";
              Type = "forking";
  