anchor.diff:                  If set, Nix will perform builds in a sandboxed environment that it
                   will set up automatically for each build. This prevents impurities
                   in builds by disallowing access to dependencies outside of the Nix
  -                store by using network and mount namespaces in a chroot environment.
  -                This is enabled by default even though it has a possible performance
  -                impact due to the initial setup time of a sandbox for each build. It
  +                store by using network and mount namespaces in a chroot environment. It
                   doesn't affect derivation hashes, so changing this option will not
                   trigger a rebuild of packages.
                 '';
  
positive.code:             trusted-users = mkOption {
                type = types.listOf types.str;
                default = [ "root" ];
                example = [ "root" "alice" "@wheel" ];
                description = ''
                  A list of names of users that have additional rights when
                  connecting to the Nix daemon, such as the ability to specify
                  additional binary caches, or to import unsigned NARs. You
                  can also specify groups by prefixing them with
                  <literal>@</literal>; for instance,
                  <literal>@wheel</literal> means all users in the wheel
                  group.
                '';
              };
  
negative.code:       name = "nix.conf";
        text = ''
          # WARNING: this file is generated from the nix.* options in
          # your nix-darwin configuration. Do not edit it!
          ${mkKeyValuePairs cfg.settings}
          ${cfg.extraOptions}
        '';
  