anchor.diff:  
     config = mkIf config.services.sshd.enable {
   
  -    users.extraUsers = pkgs.lib.singleton
  +    users.extraUsers = singleton
         { name = "sshd";
           uid = config.ids.uids.sshd;
           description = "SSH privilege separation user";
           home = "/var/empty";
  +      };
  +
  +    environment.etc = singleton
  +      { source = "${openssh}/etc/ssh/moduli";
  +        target = "ssh/moduli";
         };
   
       jobs.sshd = {
  
positive.code:         exec = "${openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
        };
  
      networking.firewall.allowedTCPPorts = cfg.ports ;
            
    };
  
  
negative.code: 
        UsePAM yes
  
        ${ concatMapStrings (port : ''Port ${toString port}
                                             '') cfg.ports}
  
        ${if cfg.forwardX11 then "
  