anchor.diff:  
       users.extraUsers.cfssl = {
         description = "cfssl user";
  -      createHome = true;
         home = cfg.dataDir;
         group = "cfssl";
         uid = config.ids.uids.cfssl;
  
positive.code: { config, lib, pkgs, ... }:
  
  with lib;
  
  
negative.code:       wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
  
        serviceConfig = lib.mkMerge [
          {
            WorkingDirectory = cfg.dataDir;
            Restart = "always";
            User = "cfssl";
  
            ExecStart = with cfg; let
              opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
            in
              lib.concatStringsSep " \\\n" [
                "${pkgs.cfssl}/bin/cfssl serve"
                (opt "address" address)
                (opt "port" (toString port))
                (opt "ca" ca)
                (opt "ca-key" caKey)
                (opt "ca-bundle" caBundle)
                (opt "int-bundle" intBundle)
                (opt "int-dir" intDir)
                (opt "metadata" metadata)
                (opt "remote" remote)
                (opt "config" configFile)
                (opt "responder" responder)
                (opt "responder-key" responderKey)
                (opt "tls-key" tlsKey)
                (opt "tls-cert" tlsCert)
                (opt "mutual-tls-ca" mutualTlsCa)
                (opt "mutual-tls-cn" mutualTlsCn)
                (opt "mutual-tls-client-key" mutualTlsClientKey)
                (opt "mutual-tls-client-cert" mutualTlsClientCert)
                (opt "tls-remote-ca" tlsRemoteCa)
                (opt "db-config" dbConfig)
                (opt "loglevel" (toString logLevel))
              ];
          }
          (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
            StateDirectory = baseNameOf cfg.dataDir;
            StateDirectoryMode = 700;
          })
        ];
      };
  
      services.cfssl = {
  