anchor.diff:    config = {
       nixosHosts.commonNixosImports = singleton ({config,...}: {
         users.users.root.password = mkForce "";
  +      programs.ssh.extraConfig = concatStringsSep "\n" sshOptions;
         services.openssh = {
           enable = true;
           permitRootLogin = mkForce "yes";
  
positive.code: with pkgs;
  with builtins;
  
  {
  
    imports = [
      ../nixos-hosts.nix
  
negative.code:     nixosHosts.hosts = mkOption {
        type = with types; attrsOf (submodule ({name, ...}: {
          config = {
            ssh.extraArgs = map (o: "-o ${o}") sshOptions;
          };
        }));
      };
  