anchor.diff:            virtualisation.memorySize = 4096;
             nix.binaryCaches = lib.mkForce [ ];
             nix.extraOptions = "experimental-features = nix-command flakes";
  -          environment.systemPackages = [ pkgs.jq ];
             networking.hosts.${(builtins.head nodes.github.config.networking.interfaces.eth1.ipv4.addresses).address} =
               [ "channels.nixos.org" "api.github.com" "github.com" ];
             security.pki.certificateFiles = [ "${cert}/ca.crt" ];
  
positive.code:               sslServerCert = "${cert}/server.crt";
                servedDirs =
                  [ { urlPath = "/repos/NixOS/nixpkgs";
                      dir = api;
                    }
                  ];
              };
  
negative.code: 
      start_all()
  
      def cat_log():
           github.succeed("cat /var/log/httpd/*.log >&2")
  
      github.wait_for_unit("httpd.service")
  
      client.succeed("curl -v https://github.com/ >&2")
      out = client.succeed("nix registry list")
      print(out)
      assert "github:NixOS/nixpkgs" in out, "nixpkgs flake not found"
      assert "github:fancy-enterprise/private-flake" in out, "private flake not found"
      cat_log()
  
      # If no github access token is provided, nix should use the public archive url...
      out = client.succeed("nix flake metadata nixpkgs --json")
      print(out)
      info = json.loads(out)
      assert info["revision"] == "${nixpkgs.rev}", f"revision mismatch: {info['revision']} != ${nixpkgs.rev}"
      cat_log()
  
      # ... otherwise it should use the API
      out = client.succeed("nix flake metadata private-flake --json --access-tokens github.com=ghp_000000000000000000000000000000000000 --tarball-ttl 0")
      print(out)
      info = json.loads(out)
      assert info["revision"] == "${private-flake-rev}", f"revision mismatch: {info['revision']} != ${private-flake-rev}"
      cat_log()
  
      client.succeed("nix registry pin nixpkgs")
      client.succeed("nix flake metadata nixpkgs --tarball-ttl 0 >&2")
  
      # Shut down the web server. The flake should be cached on the client.
      github.succeed("systemctl stop httpd.service")
  
      info = json.loads(client.succeed("nix flake metadata nixpkgs --json"))
      date = time.strftime("%Y%m%d%H%M%S", time.gmtime(info['lastModified']))
      assert date == "${nixpkgs.lastModifiedDate}", "time mismatch"
  
  