anchor.diff:        after = [ "network-online.target" "ip-up.target" ];
         wants = [ "network-online.target" "ip-up.target" ];
   
  -      script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'"; in
  +      script = let wget = "${pkgs.wget}/bin/wget --retry-connrefused -t 15 --waitretry=10 --header='Metadata-Flavor: Google'";
  +                   mktemp = "mktemp --tmpdir=/run"; in
           ''
             # When dealing with cryptographic keys, we want to keep things private.
             umask 077
  
positive.code:           if ! [ -e /root/.ssh/authorized_keys ]; then
                echo "obtaining SSH key..."
                mkdir -m 0700 -p /root/.ssh
                AUTH_KEYS=$(mktemp) && {
                  ${wget} -O $AUTH_KEYS http://metadata.google.internal/0.1/meta-data/authorized-keys
                  if [ $? -eq 0 -a -e $AUTH_KEYS ]; then
                      KEY_PUB=$(mktemp) && {
                        cat $AUTH_KEYS | cut -d: -f2- > $KEY_PUB
                        if ! grep -q -f $KEY_PUB /root/.ssh/authorized_keys; then
                            cat $KEY_PUB >> /root/.ssh/authorized_keys
  
negative.code:           countKeys=0
            ${flip concatMapStrings config.services.openssh.hostKeys (k :
              let kName = baseNameOf k.path; in ''
                PRIV_KEY=$(${mktemp}) && {
                  echo "trying to obtain SSH private host key ${kName}"
                  ${wget} -O $PRIV_KEY http://metadata.google.internal/0.1/meta-data/attributes/${kName} && :
                  if [ $? -eq 0 -a -e $PRIV_KEY ]; then
  