anchor.diff:          by making <filename>/nix/store</filename> a read-only bind
           mount.  Nix will automatically make the store writable when
           needed.
  -      '';
  -    };
  -
  -    nix.settings.substituters = mkOption {
  -      type = types.listOf types.str;
  -      description = ''
  -        List of binary cache URLs used to obtain pre-built binaries
  -        of Nix packages.
  -
  -        By default https://cache.nixos.org/ is added.
  -      '';
  -    };
  -
  -    nix.settings.trusted-substituters = mkOption {
  -      type = types.listOf types.str;
  -      default = [ ];
  -      example = [ "https://hydra.nixos.org/" ];
  -      description = ''
  -        List of binary cache URLs that non-root users can use (in
  -        addition to those specified using
  -        <option>nix.settings.substituters</option>) by passing
  -        <literal>--option binary-caches</literal> to Nix commands.
  -      '';
  -    };
  -
  -    nix.settings.require-sigs = mkOption {
  -      type = types.bool;
  -      default = true;
  -      description = ''
  -        If enabled (the default), Nix will only download binaries from binary caches if
  -        they are cryptographically signed with any of the keys listed in
  -        <option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
  -        required nor checked, so it's strongly recommended that you use only
  -        trustworthy caches and https to prevent man-in-the-middle attacks.
  -      '';
  -    };
  -
  -    nix.settings.trusted-public-keys = mkOption {
  -      type = types.listOf types.str;
  -      example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
  -      description = ''
  -        List of public keys used to sign binary caches. If
  -        <option>nix.settings.trusted-public-keys</option> is enabled,
  -        then Nix will use a binary from a binary cache if and only
  -        if it is signed by <emphasis>any</emphasis> of the keys
  -        listed here. By default, only the key for
  -        <uri>cache.nixos.org</uri> is included.
  -      '';
  -    };
  -
  -    nix.settings.trusted-users = mkOption {
  -      type = types.listOf types.str;
  -      default = [ "root" ];
  -      example = [ "root" "alice" "@wheel" ];
  -      description = ''
  -        A list of names of users that have additional rights when
  -        connecting to the Nix daemon, such as the ability to specify
  -        additional binary caches, or to import unsigned NARs. You
  -        can also specify groups by prefixing them with
  -        <literal>@</literal>; for instance,
  -        <literal>@wheel</literal> means all users in the wheel
  -        group.
  -      '';
  -    };
  -
  -    nix.settings.allowed-users = mkOption {
  -      type = types.listOf types.str;
  -      default = [ "*" ];
  -      example = [ "@wheel" "@builders" "alice" "bob" ];
  -      description = ''
  -        A list of names of users (separated by whitespace) that are
  -        allowed to connect to the Nix daemon. As with
  -        <option>nix.settings.trusted-users</option>, you can specify groups by
  -        prefixing them with <literal>@</literal>. Also, you can
  -        allow all users by specifying <literal>*</literal>. The
  -        default is <literal>*</literal>. Note that trusted users are
  -        always allowed to connect.
         '';
       };
   
  
positive.code:       '';
      };
  
      nix.daemonNiceLevel = mkOption {
        type = types.int;
        default = 0;
  
negative.code:       ";
      };
  
      nix.distributedBuilds = mkOption {
        type = types.bool;
        default = false;
  