anchor.diff:  { config, pkgs, lib, ... }: with lib;
   let
     cloudDefault = mkOverride 900;
  +
  +  fd-limit.soft = "262140";
  +  fd-limit.hard = "524280";
  +  core-limit = "1048576"; # one gigabyte
   in
   {
     # usually covered by things like security groups
  
positive.code:   services.openssh.challengeResponseAuthentication = cloudDefault false;
  
    security.polkit.enable = cloudDefault false;
    security.pam.loginLimits = [ # login sessions only, not systemd
      { domain = "*"; type = "hard"; item = "core"; value = "1048576"; }
      { domain = "*"; type = "soft"; item = "core"; value = "1048576"; } # one gigabyte
  
      { domain = "*"; type = "soft"; item = "nofile"; value = "262140"; }
      { domain = "*"; type = "hard"; item = "nofile"; value = "524280"; }
    ];
  
    systemd.extraConfig = ''
      DefaultLimitCORE=1048576
    '';
  
    boot.tmpOnTmpfs = cloudDefault true;
  
negative.code:     # allows control of core dumps with systemd-coredumpctl
      "kernel.core_pattern" = cloudDefault "|${pkgs.systemd}/lib/systemd/systemd-coredump %p %u %g %s %t %e";
  
      "fs.file-max" = cloudDefault fd-limit.hard;
  
      # moar ports
      "net.ipv4.ip_local_port_range" = cloudDefault "10000 65000";
  