anchor.diff:  
         #      "user.max_user_namespaces" = 0; # Disable user namespaces, breaks Nix 2.0
   
  -      "vm.dirty_background_ratio" =
  -        20; # Max % of RAM with dirty pages before reclaim
  +      "vm.dirty_background_ratio" = 20; # Max % of RAM with dirty pages before reclaim
         "vm.dirty_ratio" = 30; # Max % of RAM with dirty pages before STW
         "vm.dirty_writeback_centisecs" = 500; # Frequency pages are reclaimed
         "vm.dirty_expire_centisecs" = 3000; # Max age of dirty pages
         "vm.drop_caches" = 1; # Drop caches early
  +      "vm.max_map_count" = 524240; # Increase page number
         "vm.mmap_min_addr" = 65535; # Enforce memory beyond NULL space
         "vm.mmap_rnd_bits" = 32; # Raise ASLR entropy
         "vm.mmap_rnd_compat_bits" = 16; # Raise ASLR entropy
  
positive.code:     kernelPackages = lib.mkForce pkgs.linuxPackages_latest_hardened;
  
      kernelParams = [
        "nohibernate" # Disable hibernation
        "page_alloc.shuffle=1" # Enable page allocator randomization
        "page_poison=1" # Poison memory pages, wiping freed memory
        "pti=on" # Kernel page isolation
        "slab_nomerge" # Disable slab merging (Slab = chunk of memory)
        "slub_debug=FZP" # Enable sanity checks (F), redzoning (Z) and poisoning (P)
        "random.trust_cpu=off" # Enable or disable trusting the use of the CPU's random number generator
        "vsyscall=none" # vsyscall is obsolete
      ];
  
    };
  
negative.code: {
    boot = {
      blacklistedKernelModules = [
        "adfs"
        "af_802154"
        "affs"
        "appletalk"
        "atm"
        "ax25"
        "befs"
        "bfs"
        "bluetoth"
        "btusb"
        "can"
        "cifs"
        "cramfs"
        "dccp"
        "decnet"
        "econet"
        "efs"
        "erofs"
        "exofs"
        "f2fs"
        "freevxfs"
        "gfs2"
        "hfs"
        "hfsplus"
        "hpfs"
        "ipx"
        "jffs2"
        "jfs"
        "minix"
        "n-hdlc"
        "netrom"
        "nfs"
        "nfsv3"
        "nfsv4"
        "nilfs2"
        "ntfs"
        "omfs"
        "p8022"
        "p8023"
        "psnap"
        "qnx4"
        "qnx6"
        "rds"
        "rose"
        "sctp"
        "squashfs"
        "sysv"
        "tipc"
        "udf"
        "ufs"
        "uvcvideo"
        "vivid"
        "x25"
      ];
  
      initrd.kernelModules = lib.unique ([
  