anchor.diff:      # system one. Overriding this pretty bad default behaviour.
       export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
   
  -    export TOOT_LOGIN_CLI_PASSWORD="jamy-password"
  -    toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test"
  +    echo "jamy-password" | toot login_cli -i "pleroma.nixos.test" -e "jamy@nixos.test"
       echo "Login OK"
   
       # Send a toot then verify it's part of the public timeline
  
positive.code:       security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
        networking.extraHosts = hosts nodes;
        environment.systemPackages = with pkgs; [
          custom-toot
          send-toot
        ];
      };
  
negative.code:     mkdir -p $out
      cp key.pem cert.pem $out
    '';
  
    hosts = nodes: ''
      ${nodes.pleroma.config.networking.primaryIPAddress} pleroma.nixos.test
  