anchor.diff:      allowedUsers = "allowed-users";
       # systemFeatures = "system-features";
     };
  +
  +  semanticConfType = with types;
  +    let
  +      confAtom = nullOr
  +        (oneOf [
  +          bool
  +          int
  +          float
  +          str
  +          path
  +          package
  +        ]) // {
  +        description = "Nix config atom (null, bool, int, float, str, path or package)";
  +      };
  +    in
  +    attrsOf (either confAtom (listOf confAtom));
   
   in
   
  
positive.code:       done
      '';
  
    };
  
  }
  
negative.code:         description = "Additional text appended to <filename>nix.conf</filename>.";
        };
  
        settings = mkOption {
          type = types.submodule {
            freeformType = semanticConfType;
  
            options = {
              max-jobs = mkOption {
                type = types.either types.int (types.enum [ "auto" ]);
                default = "auto";
                example = 64;
                description = ''
                  This option defines the maximum number of jobs that Nix will try to
                  build in parallel. The default is auto, which means it will use all
                  available logical cores. It is recommend to set it to the total
                  number of logical cores in your system (e.g., 16 for two CPUs with 4
                  cores each and hyper-threading).
                '';
              };
  
              auto-optimise-store = mkOption {
                type = types.bool;
                default = false;
                example = true;
                description = ''
                  If set to true, Nix automatically detects files in the store that have
                  identical contents, and replaces them with hard links to a single copy.
                  This saves disk space. If set to false (the default), you can still run
                  nix-store --optimise to get rid of duplicate files.
                '';
              };
  
              cores = mkOption {
                type = types.int;
                default = 0;
                example = 64;
                description = ''
                  This option defines the maximum number of concurrent tasks during
                  one build. It affects, e.g., -j option for make.
                  The special value 0 means that the builder should use all
                  available CPU cores in the system. Some builds may become
                  non-deterministic with this option; use with care! Packages will
                  only be affected if enableParallelBuilding is set for them.
                '';
              };
  
              sandbox = mkOption {
                type = types.either types.bool (types.enum [ "relaxed" ]);
                default = false;
                description = ''
                  If set, Nix will perform builds in a sandboxed environment that it
                  will set up automatically for each build. This prevents impurities
                  in builds by disallowing access to dependencies outside of the Nix
                  store by using network and mount namespaces in a chroot environment.
                  This is enabled by default even though it has a possible performance
                  impact due to the initial setup time of a sandbox for each build. It
                  doesn't affect derivation hashes, so changing this option will not
                  trigger a rebuild of packages.
                '';
              };
  
              extra-sandbox-paths = mkOption {
                type = types.listOf types.str;
                default = [ ];
                example = [ "/dev" "/proc" ];
                description = ''
                  Directories from the host filesystem to be included
                  in the sandbox.
                '';
              };
  
              substituters = mkOption {
                type = types.listOf types.str;
                description = ''
                  List of binary cache URLs used to obtain pre-built binaries
                  of Nix packages.
  
                  By default https://cache.nixos.org/ is added.
                '';
              };
  
              trusted-substituters = mkOption {
                type = types.listOf types.str;
                default = [ ];
                example = [ "https://hydra.nixos.org/" ];
                description = ''
                  List of binary cache URLs that non-root users can use (in
                  addition to those specified using
                  <option>nix.settings.substituters</option>) by passing
                  <literal>--option binary-caches</literal> to Nix commands.
                '';
              };
  
              require-sigs = mkOption {
                type = types.bool;
                default = true;
                description = ''
                  If enabled (the default), Nix will only download binaries from binary caches if
                  they are cryptographically signed with any of the keys listed in
                  <option>nix.settings.trusted-public-keys</option>. If disabled, signatures are neither
                  required nor checked, so it's strongly recommended that you use only
                  trustworthy caches and https to prevent man-in-the-middle attacks.
                '';
              };
  
              trusted-public-keys = mkOption {
                type = types.listOf types.str;
                example = [ "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" ];
                description = ''
                  List of public keys used to sign binary caches. If
                  <option>nix.settings.trusted-public-keys</option> is enabled,
                  then Nix will use a binary from a binary cache if and only
                  if it is signed by <emphasis>any</emphasis> of the keys
                  listed here. By default, only the key for
                  <uri>cache.nixos.org</uri> is included.
                '';
              };
  
              trusted-users = mkOption {
                type = types.listOf types.str;
                default = [ "root" ];
                example = [ "root" "alice" "@wheel" ];
                description = ''
                  A list of names of users that have additional rights when
                  connecting to the Nix daemon, such as the ability to specify
                  additional binary caches, or to import unsigned NARs. You
                  can also specify groups by prefixing them with
                  <literal>@</literal>; for instance,
                  <literal>@wheel</literal> means all users in the wheel
                  group.
                '';
              };
  
              # Not implemented yet
              # system-features = mkOption {
              #   type = types.listOf types.str;
              #   example = [ "kvm" "big-parallel" "gccarch-skylake" ];
              #   description = ''
              #     The set of features supported by the machine. Derivations
              #     can express dependencies on system features through the
              #     <literal>requiredSystemFeatures</literal> attribute.
  
              #     By default, pseudo-features <literal>nixos-test</literal>, <literal>benchmark</literal>,
              #     and <literal>big-parallel</literal> used in Nixpkgs are set, <literal>kvm</literal>
              #     is also included in it is avaliable.
              #   '';
              # };
  
              allowed-users = mkOption {
                type = types.listOf types.str;
                default = [ "*" ];
                example = [ "@wheel" "@builders" "alice" "bob" ];
                description = ''
                  A list of names of users (separated by whitespace) that are
                  allowed to connect to the Nix daemon. As with
                  <option>nix.settings.trusted-users</option>, you can specify groups by
                  prefixing them with <literal>@</literal>. Also, you can
                  allow all users by specifying <literal>*</literal>. The
                  default is <literal>*</literal>. Note that trusted users are
                  always allowed to connect.
                '';
              };
            };
          };
          default = { };
          example = literalExpression ''
            {
              use-sandbox = true;
              show-trace = true;
  
              system-features = [ "big-parallel" "kvm" "recursive-nix" ];
              sandbox-paths = { "/bin/sh" = "''${pkgs.busybox-sandbox-shell.out}/bin/busybox"; };
            }
          '';
          description = ''
            Configuration for Nix, see
            <link xlink:href="https://nixos.org/manual/nix/stable/#sec-conf-file"/> or
            <citerefentry>
              <refentrytitle>nix.conf</refentrytitle>
              <manvolnum>5</manvolnum>
            </citerefentry> for avalaible options.
            The value declared here will be translated directly to the key-value pairs Nix expects.
            </para>
            <para>
            You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.nix.settings</command>
            to view the current value. By default it is empty.
            </para>
            <para>
            Nix configurations defined under <option>nix.*</option> will be translated and applied to this
            option. In addition, configuration specified in <option>nix.extraOptions</option> which will be appended
            verbatim to the resulting config file.
          '';
        };
      };
    };
  