anchor.diff:  
     nixConf =
       let
  -      # If we're using sandbox for builds, then provide /bin/sh in
  -      # the sandbox as a bind-mount to bash. This means we also need to
  -      # include the entire closure of bash.
  +      # In Nix < 2.0, If we're using sandbox for builds, then provide
  +      # /bin/sh in the sandbox as a bind-mount to bash. This means we
  +      # also need to include the entire closure of bash. Nix >= 2.0
  +      # provides a /bin/sh by default.
         sh = pkgs.stdenv.shell;
         binshDeps = pkgs.writeReferencesToFile sh;
       in
  -      pkgs.runCommand "nix.conf" {extraOptions = cfg.extraOptions; } ''
  -        extraPaths=$(for i in $(cat ${binshDeps}); do if test -d $i; then echo $i; fi; done)
  +      pkgs.runCommand "nix.conf" { extraOptions = cfg.extraOptions; inherit binshDeps; } ''
  +        ${optionalString (!isNix20) ''
  +          extraPaths=$(for i in $(cat binshDeps); do if test -d $i; then echo $i; fi; done)
  +        ''}
           cat > $out <<END
           # WARNING: this file is generated from the nix.* options in
           # your NixOS configuration, typically
           # /etc/nixos/configuration.nix.  Do not edit it!
           build-users-group = nixbld
  -        build-max-jobs = ${toString (cfg.maxJobs)}
  -        build-cores = ${toString (cfg.buildCores)}
  -        build-use-sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
  -        build-sandbox-paths = ${toString cfg.sandboxPaths} /bin/sh=${sh} $(echo $extraPaths)
  -        binary-caches = ${toString cfg.binaryCaches}
  -        trusted-binary-caches = ${toString cfg.trustedBinaryCaches}
  -        binary-cache-public-keys = ${toString cfg.binaryCachePublicKeys}
  +        ${if isNix20 then "max-jobs" else "build-max-jobs"} = ${toString (cfg.maxJobs)}
  +        ${if isNix20 then "cores" else "build-cores"} = ${toString (cfg.buildCores)}
  +        ${if isNix20 then "sandbox" else "build-use-sandbox"} = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
  +        ${if isNix20 then "extra-sandbox-paths" else "build-sandbox-paths"} = ${toString cfg.sandboxPaths} ${optionalString (!isNix20) "/bin/sh=${sh} $(echo $extraPaths)"}
  +        ${if isNix20 then "substituters" else "binary-caches"} = ${toString cfg.binaryCaches}
  +        ${if isNix20 then "trusted-substituters" else "trusted-binary-caches"} = ${toString cfg.trustedBinaryCaches}
  +        ${if isNix20 then "trusted-public-keys" else "binary-cache-public-keys"} = ${toString cfg.binaryCachePublicKeys}
           auto-optimise-store = ${boolToString cfg.autoOptimiseStore}
  -        ${optionalString cfg.requireSignedBinaryCaches ''
  -          signed-binary-caches = *
  +        ${if isNix20 then ''
  +          require-sigs = ${if cfg.requireSignedBinaryCaches then "true" else "false"}
  +        '' else ''
  +          signed-binary-caches = ${if cfg.requireSignedBinaryCaches then "*" else ""}
           ''}
           trusted-users = ${toString cfg.trustedUsers}
           allowed-users = ${toString cfg.allowedUsers}
  +        ${optionalString (isNix20 && !cfg.distributedBuilds) ''
  +          builders =
  +        ''}
           $extraOptions
           END
         '';
  
positive.code: 
    nix = cfg.package.out;
  
    isNix112 = versionAtLeast (getVersion nix) "1.12pre";
  
    makeNixBuildUser = nr:
      { name = "nixbld${toString nr}";
  
negative.code:     systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];
  
      systemd.services.nix-daemon =
        { path = [ nix pkgs.utillinux ]
            ++ optionals cfg.distributedBuilds [ config.programs.ssh.package pkgs.gzip ]
            ++ optionals (!isNix20) [ pkgs.openssl.bin ];
  
          environment = cfg.envVars
            // { CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"; }
  