anchor.diff:        default = {};
         description = "Configuration for users.";
       };
  +
  +    users.forceRecreate = mkOption {
  +      internal = true;
  +      type = types.bool;
  +      default = false;
  +      description = "Remove and recreate existing groups/users.";
  +    };
     };
   
     config = {
  
positive.code:       echo "setting up groups..." >&2
  
        ${concatMapStringsSep "\n" (v: ''
          g=$(dscl . -read '/Groups/${v.name}' PrimaryGroupID 2> /dev/null) || true
          g=''${g#PrimaryGroupID: }
          if [ -z "$g" ]; then
  
negative.code:       echo "setting up users..." >&2
  
        ${concatMapStringsSep "\n" (v: ''
          ${optionalString cfg.forceRecreate ''
            u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
            u=''${u#UniqueID: }
            if [ "$u" -eq ${toString v.uid} ]; then
              echo "deleting user ${v.name}..." >&2
              dscl . -delete '/Users/${v.name}' 2> /dev/null
            else
              echo "[1;31mwarning: existing user '${v.name}' has unexpected uid $u, skipping...[0m" >&2
            fi
          ''}
  
          u=$(dscl . -read '/Users/${v.name}' UniqueID 2> /dev/null) || true
          u=''${u#UniqueID: }
          if [ -z "$u" ]; then
  