anchor.diff:        '';
       };
   
  -    # TODO
       SoftResourceLimits = mkOption {
  -      type = types.nullOr (types.attrsOf types.int);
  -      default = null;
  -    };
  -
  -    # TODO
  -    HardResourceLimits = mkOption {
  -      type = types.nullOr (types.attrsOf types.int);
  -      default = null;
  -      example = { NumberOfFiles = 4096; };
  +      default = null;
         description = ''
           Resource limits to be imposed on the job. These adjust variables set with setrlimit(2).  The following
           keys apply:
  -
  -           Core <integer>
  -           The largest size (in bytes) core file that may be created.
  -
  -           CPU <integer>
  -           The maximum amount of cpu time (in seconds) to be used by each process.
  -
  -           Data <integer>
  -           The maximum size (in bytes) of the data segment for a process; this defines how far a program may
  -           extend its break with the sbrk(2) system call.
  -
  -           FileSize <integer>
  -           The largest size (in bytes) file that may be created.
  -
  -           MemoryLock <integer>
  -           The maximum size (in bytes) which a process may lock into memory using the mlock(2) function.
  -
  -           NumberOfFiles <integer>
  -           The maximum number of open files for this process.  Setting this value in a system wide daemon
  -           will set the sysctl(3) kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResource-Limits) (HardResourceLimits)
  -           Limits) value in addition to the setrlimit(2) values.
  -
  -           NumberOfProcesses <integer>
  -           The maximum number of simultaneous processes for this user id.  Setting this value in a system
  -           wide daemon will set the sysctl(3) kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
  -           (HardResourceLimits) value in addition to the setrlimit(2) values.
  -
  -           ResidentSetSize <integer>
  -           The maximum size (in bytes) to which a process's resident set size may grow.  This imposes a
  -           limit on the amount of physical memory to be given to a process; if memory is tight, the system
  -           will prefer to take memory from processes that are exceeding their declared resident set size.
  -
  -           Stack <integer>
  -           The maximum size (in bytes) of the stack segment for a process; this defines how far a program's
  -           stack segment may be extended.  Stack extension is performed automatically by the system.
  -      '';
  +      '';
  +      type = types.nullOr (types.submodule {
  +        options = {
  +          Core = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The largest size (in bytes) core file that may be created.
  +            '';
  +          };
  +
  +          CPU = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum amount of cpu time (in seconds) to be used by each process.
  +            '';
  +          };
  +
  +          Data = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) of the data segment for a process; this defines how far a program may
  +              extend its break with the sbrk(2) system call.
  +            '';
  +          };
  +
  +          FileSize = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The largest size (in bytes) file that may be created.
  +            '';
  +          };
  +
  +          MemoryLock = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) which a process may lock into memory using the mlock(2) function.
  +            '';
  +          };
  +
  +          NumberOfFiles = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum number of open files for this process.  Setting this value in a system wide daemon
  +              will set the sysctl(3) kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResource-Limits) (HardResourceLimits)
  +              Limits) value in addition to the setrlimit(2) values.
  +            '';
  +          };
  +
  +          NumberOfProcesses = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum number of simultaneous processes for this user id.  Setting this value in a system
  +              wide daemon will set the sysctl(3) kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
  +              (HardResourceLimits) value in addition to the setrlimit(2) values.
  +            '';
  +          };
  +
  +          ResidentSetSize = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) to which a process's resident set size may grow.  This imposes a
  +              limit on the amount of physical memory to be given to a process; if memory is tight, the system
  +              will prefer to take memory from processes that are exceeding their declared resident set size.
  +            '';
  +          };
  +
  +          Stack = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) of the stack segment for a process; this defines how far a program's
  +              stack segment may be extended.  Stack extension is performed automatically by the system.
  +            '';
  +          };
  +        };
  +      });
  +    };
  +
  +    HardResourceLimits = mkOption {
  +      default = null;
  +      example = { NumberOfFiles = 4096; };
  +      description = ''
  +        Resource limits to be imposed on the job. These adjust variables set with setrlimit(2).  The following
  +        keys apply:
  +      '';
  +      type = types.nullOr (types.submodule {
  +        options = {
  +          Core = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The largest size (in bytes) core file that may be created.
  +            '';
  +          };
  +
  +          CPU = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum amount of cpu time (in seconds) to be used by each process.
  +            '';
  +          };
  +
  +          Data = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) of the data segment for a process; this defines how far a program may
  +              extend its break with the sbrk(2) system call.
  +            '';
  +          };
  +
  +          FileSize = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The largest size (in bytes) file that may be created.
  +            '';
  +          };
  +
  +          MemoryLock = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) which a process may lock into memory using the mlock(2) function.
  +            '';
  +          };
  +
  +          NumberOfFiles = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum number of open files for this process.  Setting this value in a system wide daemon
  +              will set the sysctl(3) kern.maxfiles (SoftResourceLimits) or kern.maxfilesperproc (HardResource-Limits) (HardResourceLimits)
  +              Limits) value in addition to the setrlimit(2) values.
  +            '';
  +          };
  +
  +          NumberOfProcesses = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum number of simultaneous processes for this user id.  Setting this value in a system
  +              wide daemon will set the sysctl(3) kern.maxproc (SoftResourceLimits) or kern.maxprocperuid
  +              (HardResourceLimits) value in addition to the setrlimit(2) values.
  +            '';
  +          };
  +
  +          ResidentSetSize = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) to which a process's resident set size may grow.  This imposes a
  +              limit on the amount of physical memory to be given to a process; if memory is tight, the system
  +              will prefer to take memory from processes that are exceeding their declared resident set size.
  +            '';
  +          };
  +
  +          Stack = mkOption {
  +            type = types.nullOr types.int;
  +            default = null;
  +            description = ''
  +              The maximum size (in bytes) of the stack segment for a process; this defines how far a program's
  +              stack segment may be extended.  Stack extension is performed automatically by the system.
  +            '';
  +          };
  +        };
  +      });
       };
   
       Nice = mkOption {
  
positive.code:       '';
      };
  
      # TODO
      inetdCompatibility = mkOption {
        type = types.nullOr (types.attrsOf types.bool);
        default = null;
        example = { Wait = true; };
        description = ''
          The presence of this key specifies that the daemon expects to be run as if it were launched from inetd.
  
          This flag corresponds to the "wait" or "nowait" option of inetd. If true, then the listening
          socket is passed via the standard in/out/error file descriptors. If false, then accept(2) is
          called on behalf of the job, and the result is passed via the standard in/out/error descriptors.
        '';
      };
  
      LimitLoadToHosts = mkOption {
  
negative.code:       '';
      };
  
      StartCalendarInterval = mkOption {
        default = null;
        example = { Hour = 2; Minute = 30; };
        description = ''
  