anchor.diff:  
           path = [ pkgs.chrony ];
   
  -        preStart = ''
  -          mkdir -m 0755 -p ${stateDir}
  -          touch ${keyFile}
  -          chmod 0640 ${keyFile}
  -          chown chrony:chrony ${stateDir} ${keyFile}
  -        '';
  -
           unitConfig.ConditionCapability = "CAP_SYS_TIME";
           serviceConfig =
             { Type = "simple";
  
positive.code:             ProtectHome = "yes";
              ProtectSystem = "full";
              PrivateTmp = "yes";
  
            };
  
        };
  
negative.code: 
      systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
  
      systemd.tmpfiles.rules = [
        "d ${stateDir} 0755 chrony chrony - -"
        "f ${keyFile} 0640 chrony chrony -"
      ];
  
      systemd.services.chronyd =
        { description = "chrony NTP daemon";
  
  