anchor.diff: -import ./make-test.nix {
  +import ./make-test.nix ({ pkgs, ... }: let
  +  snakeOil = pkgs.runCommand "snakeoil-certs" {
  +    outputs = [ "out" "cacert" "cert" "key" "crl" ];
  +    buildInputs = [ pkgs.gnutls.bin ];
  +    caTemplate = pkgs.writeText "snakeoil-ca.template" ''
  +      cn = server
  +      expiration_days = -1
  +      cert_signing_key
  +      ca
  +    '';
  +    certTemplate = pkgs.writeText "snakeoil-cert.template" ''
  +      cn = server
  +      expiration_days = -1
  +      tls_www_server
  +      encryption_key
  +      signing_key
  +    '';
  +    crlTemplate = pkgs.writeText "snakeoil-crl.template" ''
  +      expiration_days = -1
  +    '';
  +    userCertTemplace = pkgs.writeText "snakoil-user-cert.template" ''
  +      organization = snakeoil
  +      cn = server
  +      expiration_days = -1
  +      tls_www_client
  +      encryption_key
  +      signing_key
  +    '';
  +  } ''
  +    certtool -p --bits 4096 --outfile ca.key
  +    certtool -s --template "$caTemplate" --load-privkey ca.key \
  +                --outfile "$cacert"
  +    certtool -p --bits 4096 --outfile "$key"
  +    certtool -c --template "$certTemplate" \
  +                --load-ca-privkey ca.key \
  +                --load-ca-certificate "$cacert" \
  +                --load-privkey "$key" \
  +                --outfile "$cert"
  +    certtool --generate-crl --template "$crlTemplate" \
  +                            --load-ca-privkey ca.key \
  +                            --load-ca-certificate "$cacert" \
  +                            --outfile "$crl"
  +
  +    mkdir "$out"
  +
  +    # Stripping key information before the actual PEM-encoded values is solely
  +    # to make test output a bit less verbose when copying the client key to the
  +    # actual client.
  +    certtool -p --bits 4096 | sed -n \
  +      -e '/^----* *BEGIN/,/^----* *END/p' > "$out/alice.key"
  +
  +    certtool -c --template "$userCertTemplace" \
  +                --load-privkey "$out/alice.key" \
  +                --load-ca-privkey ca.key \
  +                --load-ca-certificate "$cacert" \
  +                --outfile "$out/alice.cert"
  +  '';
  +
  +in {
     name = "taskserver";
   
     nodes = rec {
  
positive.code:       return "su - $user -c '$esc'";
      }
  
      sub setupClientsFor ($$) {
        my ($org, $user) = @_;
  
        for my $client ($client1, $client2) {
          $client->nest("initialize client for user $user", sub {
  
negative.code:       };
      };
  
      # New generation of the server with manual config
      newServer = { lib, nodes, ... }: {
        imports = [ server ];
        services.taskserver.pki.manual = {
          ca.cert = snakeOil.cacert;
          server.cert = snakeOil.cert;
          server.key = snakeOil.key;
          server.crl = snakeOil.crl;
        };
        # This is to avoid assigning a different network address to the new
        # generation.
        networking = lib.mapAttrs (lib.const lib.mkForce) {
          inherit (nodes.server.config.networking)
            hostName interfaces primaryIPAddress extraHosts;
        };
      };
  
      client1 = { pkgs, ... }: {
        environment.systemPackages = [ pkgs.taskwarrior pkgs.gnutls ];
        users.users.alice.isNormalUser = true;
  