anchor.diff:        return su $user, $cmd;
       }
   
  -    startAll;
  +    # Explicitly start the VMs so that we don't accidentally start newServer
  +    $server->start;
  +    $client1->start;
  +    $client2->start;
   
       $server->waitForUnit("taskserver.service");
   
  
positive.code:   testScript = { nodes, ... }: let
      cfg = nodes.server.config.services.taskserver;
      portStr = toString cfg.listenPort;
    in ''
      sub su ($$) {
        my ($user, $cmd) = @_;
  
negative.code:       };
      };
  
      # New generation of the server with manual config
      newServer = { lib, nodes, ... }: {
        imports = [ server ];
        services.taskserver.pki.manual = {
          ca.cert = snakeOil.cacert;
          server.cert = snakeOil.cert;
          server.key = snakeOil.key;
          server.crl = snakeOil.crl;
        };
        # This is to avoid assigning a different network address to the new
        # generation.
        networking = lib.mapAttrs (lib.const lib.mkForce) {
          inherit (nodes.server.config.networking)
            hostName interfaces primaryIPAddress extraHosts;
        };
      };
  
      client1 = { pkgs, ... }: {
        environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
        users.users.alice.isNormalUser = true;
  