anchor.diff:    meta = with pkgs.stdenv.lib.maintainers; {
       maintainers = [ lewo ];
     };
  -  machine =
  -    { ... }:
  -    {
  -      virtualisation.qemu.options = [ "-cdrom" "${metadataDrive}/metadata.iso" ];
  -      services.cloud-init.enable = true;
  -    };
  +  machine = { ... }:
  +  {
  +    virtualisation.qemu.options = [ "-cdrom" "${metadataDrive}/metadata.iso" ];
  +    services.cloud-init.enable = true;
  +    services.openssh.enable = true;
  +
  +  };
     testScript = ''
  -      machine.start()
  -      machine.wait_for_unit("cloud-init.service")
  -      machine.succeed("cat /tmp/cloudinit-write-file | grep -q 'cloudinit'")
  +    machine.wait_for_unit("cloud-init.service")
  +    machine.succeed("cat /tmp/cloudinit-write-file | grep -q 'cloudinit'")
   
  -      machine.wait_until_succeeds("cat /root/.ssh/authorized_keys | grep -q root@test")
  +    # install snakeoil ssh key and provision .ssh/config file
  +    machine.succeed("mkdir -p ~/.ssh")
  +    machine.succeed(
  +        "cat ${snakeOilPrivateKey} > ~/.ssh/id_snakeoil"
  +    )
  +    machine.succeed("chmod 600 ~/.ssh/id_snakeoil")
  +
  +    machine.wait_for_unit("sshd.service")
  +
  +    # we should be able to log in as the root user, as well as the created nixos user
  +    machine.succeed(
  +        "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/id_snakeoil root@localhost 'true'"
  +    )
  +    machine.succeed(
  +        "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o IdentityFile=~/.ssh/id_snakeoil nixos@localhost 'true'"
  +    )
     '';
   }
  
positive.code:       -   content: |
                  cloudinit
            path: /tmp/cloudinit-write-file
        EOF
  
        cat << EOF > $out/iso/meta-data
        instance-id: iid-local01
        local-hostname: "test"
        public-keys:
          ec2-keypair.us-east-1:
            - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5L7Xuh49VS5VQheFE7VDmXKH0BOnB1R0avAE91QgOB root@test
        EOF
        ${pkgs.cdrkit}/bin/genisoimage -volid cidata -joliet -rock -o $out/metadata.iso $out/iso
        '';
  
negative.code: with pkgs.lib;
  
  let
    inherit (import ./ssh-keys.nix pkgs)
      snakeOilPrivateKey snakeOilPublicKey;
  
    metadataDrive = pkgs.stdenv.mkDerivation {
      name = "metadata";
      buildCommand = ''
  