anchor.diff:        preStart = ''
           mkdir -m 0755 -p ${stateDir}
         '';
  -      script = "${heimdalFull}/libexec/heimdal/kdc";
  +      script = "${pkgs.heimdalFull}/libexec/heimdal/kdc";
       };
   
       systemd.services.kpasswdd = {
         description = "Kerberos Password Changing daemon";
         wantedBy = [ "multi-user.target" ];
  -      script = "${heimdalFull}/libexec/heimdal/kpasswdd";
  +      script = "${pkgs.heimdalFull}/libexec/heimdal/kpasswdd";
       };
     };
   }
  
positive.code: {pkgs, config, lib, ...}:
  
  let
  
    inherit (lib) mkOption mkIf;
  
    inherit (pkgs) heimdalFull;
  
    stateDir = "/var/heimdal";
  in
  
  {
  
    ###### interface
  
    options = {
  
      services.kerberos_server = {
  
        enable = mkOption {
          default = false;
          description = ''
  
negative.code:       };
  
      };
    };
  
  
    ###### implementation
  
    config = mkIf cfg.enable {
      environment.systemPackages = [ pkgs.heimdalFull ];
      systemd.services.kadmind = {
        description = "Kerberos Administration Daemon";
        script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
  