anchor.diff:          GatewayPorts ${cfg.gatewayPorts}
           PasswordAuthentication ${if cfg.passwordAuthentication then "yes" else "no"}
           ChallengeResponseAuthentication ${if cfg.challengeResponseAuthentication then "yes" else "no"}
  +
  +        AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2 /etc/ssh/authorized_keys.d/%u
         '';
   
       assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  
positive.code:         home = "/var/empty";
        };
  
      environment.etc = [
        { source = "${pkgs.openssh}/etc/ssh/moduli";
          target = "ssh/moduli";
        }
  
negative.code: 
    userOptions = {
      openssh.authorizedKeys = {
        keys = mkOption {
          type = types.listOf types.string;
          default = [];
          description = ''
            A list of verbatim OpenSSH public keys that should be added to the
            user's authorized keys. The keys are added to a file that the SSH
            daemon reads in addition to the the user's authorized_keys file.
            You can combine the <literal>keys</literal> and
            <literal>keyFiles</literal> options.
          '';
        };
  
        keyFiles = mkOption {
          default = [];
          description = ''
            A list of files each containing one OpenSSH public key that should be
            added to the user's authorized keys. The contents of the files are
            read at build time and added to a file that the SSH daemon reads in
            addition to the the user's authorized_keys file. You can combine the
            <literal>keyFiles</literal> and <literal>keys</literal> options.
          '';
        };
      };
    };
  
    authKeysFiles = with {
      mkAuthKeyFile = u: {
        target = "ssh/authorized_keys.d/${u.name}";
        mode = "0444";
        source = pkgs.writeText "${u.name}-authorized_keys" ''
          ${concatStringsSep "\n" u.openssh.authorizedKeys.keys}
          ${concatMapStrings (f: builtins.readFile f + "\n") u.openssh.authorizedKeys.keyFiles}
        '';
      };
      usersWithKeys = attrValues (flip filterAttrs config.users.extraUsers (n: u:
        length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
      ));
    }; map mkAuthKeyFile usersWithKeys;
  
  in
  
  