anchor.diff:          ];
         };
   
  +    server_lazy =
  +      { config, pkgs, ... }:
  +
  +      {
  +        services.openssh = { enable = true; startWhenNeeded = true; };
  +        security.pam.services.sshd.limits =
  +          [ { domain = "*"; item = "memlock"; type = "-"; value = 1024; } ];
  +        users.extraUsers.root.openssh.authorizedKeys.keys = [
  +          snakeOilPublicKey
  +        ];
  +      };
  +
       client =
         { config, pkgs, ... }: { };
   
  
positive.code:     subtest "manual-authkey", sub {
        $server->succeed("mkdir -m 700 /root/.ssh");
        $server->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
  
        $client->succeed("mkdir -m 700 /root/.ssh");
        $client->copyFileFromHost("key", "/root/.ssh/id_ed25519");
  
negative.code:       $client->waitForUnit("network.target");
        $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'echo hello world' >&2");
        $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server 'ulimit -l' | grep 1024");
  
        $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'echo hello world' >&2");
        $client->succeed("ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no server_lazy 'ulimit -l' | grep 1024");
  
      };
  
      subtest "configured-authkey", sub {
  