anchor.diff:              ProtectHome = "yes";
               ProtectSystem = "full";
               PrivateTmp = "yes";
  -
  +            StateDirectory = "chrony";
             };
   
         };
  
positive.code: 
          path = [ pkgs.chrony ];
  
          preStart = ''
            mkdir -m 0755 -p ${stateDir}
            touch ${keyFile}
            chmod 0640 ${keyFile}
            chown chrony:chrony ${stateDir} ${keyFile}
          '';
  
          unitConfig.ConditionCapability = "CAP_SYS_TIME";
          serviceConfig =
            { Type = "simple";
  
negative.code: 
      systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
  
      systemd.tmpfiles.rules = [
        "d ${stateDir} 0755 chrony chrony - -"
        "f ${keyFile} 0640 chrony chrony -"
      ];
  
      systemd.services.chronyd =
        { description = "chrony NTP daemon";
  
  