anchor.diff:      nixosHosts.hosts = mkOption {
         type = with types; attrsOf (submodule ({name, ...}: {
           config = {
  -          ssh.extraArgs = [
  -            "-q"
  -            "-o PreferredAuthentications=password"
  -            "-o StrictHostKeyChecking=no"
  -            "-o UserKnownHostsFile=/dev/null"
  -          ];
  +          ssh.extraArgs = map (o: "-o ${o}") sshOptions;
           };
         }));
       };
  
positive.code: with pkgs;
  with builtins;
  
  {
  
    imports = [
      ../nixos-hosts.nix
  
negative.code:   config = {
      nixosHosts.commonNixosImports = singleton ({config,...}: {
        users.users.root.password = mkForce "";
        programs.ssh.extraConfig = concatStringsSep "\n" sshOptions;
        services.openssh = {
          enable = true;
          permitRootLogin = mkForce "yes";
  