anchor.diff:  
       systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };
   
  +    systemd.tmpfiles.rules = [
  +      "d ${stateDir} 0755 chrony chrony - -"
  +      "f ${keyFile} 0640 chrony chrony -"
  +    ];
  +
       systemd.services.chronyd =
         { description = "chrony NTP daemon";
   
  
positive.code:             ProtectHome = "yes";
              ProtectSystem = "full";
              PrivateTmp = "yes";
  
            };
  
        };
  
negative.code: 
          path = [ pkgs.chrony ];
  
          unitConfig.ConditionCapability = "CAP_SYS_TIME";
          serviceConfig =
            { Type = "simple";
  