anchor.diff:          default = [22];
           description = ''
             Specifies on which ports the SSH daemon listens.
  +        '';
  +      };
  +
  +      openFirewall = mkOption {
  +        type = types.bool;
  +        default = true;
  +        description = ''
  +          Whether to automatically open the specified ports in the firewall.
           '';
         };
   
  
positive.code:           daemon reads in addition to the the user's authorized_keys file.
            You can combine the <literal>keys</literal> and
            <literal>keyFiles</literal> options.
            Warning: If you are using <literal>NixOps</literal> then don't use this 
            option since it will replace the key required for deployment via ssh.
          '';
        };
  
negative.code: 
        };
  
      networking.firewall.allowedTCPPorts = if cfg.openFirewall then cfg.ports else [];
  
      security.pam.services.sshd =
        { startSession = true;
  