anchor.diff:        description = "The version of nix. Used to determine what settings to configure in nix.conf";
       };
   
  +    # Not in NixOS module
       nix.useDaemon = mkOption {
         type = types.bool;
         default = false;
  
positive.code:         by making <filename>/nix/store</filename> a read-only bind
          mount.  Nix will automatically make the store writable when
          needed.
        '';
      };
  
      nix.settings.substituters = mkOption {
        type = types.listOf types.str;
        description = ''
          List of binary cache URLs used to obtain pre-built binaries
          of Nix packages.
  
          By default https://cache.nixos.org/ is added.
        '';
      };
  
      nix.settings.trusted-substituters = mkOption {
        type = types.listOf types.str;
        default = [ ];
        example = [ "https://hydra.nixos.org/" ];
        description = ''
          List of binary cache URLs that non-root users can use (in
          addition to those specified using
          <option>nix.settings.substituters</option>) by passing
          <literal>--option binary-caches</literal> to Nix commands.
        '';
      };
  
      nix.settings.require-sigs = mkOption {
        type = types.bool;
        default = true;
        description = ''
          If enabled (the default), Nix will only download binaries from binary caches if
          they are cryptographically signed with any of the keys listed in
          <option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
          required nor checked, so it's strongly recommended that you use only
          trustworthy caches and https to prevent man-in-the-middle attacks.
        '';
      };
  
      nix.settings.trusted-public-keys = mkOption {
        type = types.listOf types.str;
        example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
        description = ''
          List of public keys used to sign binary caches. If
          <option>nix.settings.trusted-public-keys</option> is enabled,
          then Nix will use a binary from a binary cache if and only
          if it is signed by <emphasis>any</emphasis> of the keys
          listed here. By default, only the key for
          <uri>cache.nixos.org</uri> is included.
        '';
      };
  
      nix.settings.trusted-users = mkOption {
        type = types.listOf types.str;
        default = [ "root" ];
        example = [ "root" "alice" "@wheel" ];
        description = ''
          A list of names of users that have additional rights when
          connecting to the Nix daemon, such as the ability to specify
          additional binary caches, or to import unsigned NARs. You
          can also specify groups by prefixing them with
          <literal>@</literal>; for instance,
          <literal>@wheel</literal> means all users in the wheel
          group.
        '';
      };
  
      nix.settings.allowed-users = mkOption {
        type = types.listOf types.str;
        default = [ "*" ];
        example = [ "@wheel" "@builders" "alice" "bob" ];
        description = ''
          A list of names of users (separated by whitespace) that are
          allowed to connect to the Nix daemon. As with
          <option>nix.settings.trusted-users</option>, you can specify groups by
          prefixing them with <literal>@</literal>. Also, you can
          allow all users by specifying <literal>*</literal>. The
          default is <literal>*</literal>. Note that trusted users are
          always allowed to connect.
        '';
      };
  
  
negative.code:       ";
      };
  
      nix.distributedBuilds = mkOption {
        type = types.bool;
        default = false;
  