anchor.diff:        done
       '';
   
  +    # Legacy configuration conversion.
  +    nix.settings = mkMerge [
  +      {
  +        trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
  +        substituters = mkAfter [ "https://cache.nixos.org/" ];
  +
  +        # Not implemented yet
  +        # system-features = mkDefault (
  +        #   [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++
  +        #   optionals (pkgs.hostPlatform ? gcc.arch) (
  +        #     # a builder can run code for `gcc.arch` and inferior architectures
  +        #     [ "gccarch-${pkgs.hostPlatform.gcc.arch}" ] ++
  +        #     map (x: "gccarch-${x}") systems.architectures.inferiors.${pkgs.hostPlatform.gcc.arch}
  +        #   )
  +        # );
  +      }
  +
  +      (mkIf (!cfg.distributedBuilds) { builders = null; })
  +
  +      (mkIf (isNixAtLeast "2.3pre") { sandbox-fallback = false; })
  +
  +      # Not in NixOS module
  +      (mkIf cfg.useDaemon { build-users-group = "nixbld"; })
  +    ];
  +
     };
   
   }
  
positive.code: 
    nixPackage = cfg.package.out;
  
    nixConf =
      let
        # If we're using sandbox for builds, then provide /bin/sh in
        # the sandbox as a bind-mount to bash. This means we also need to
        # include the entire closure of bash.
        sh = pkgs.stdenv.shell;
        binshDeps = pkgs.writeReferencesToFile sh;
      in
        pkgs.runCommandNoCC "nix.conf"
          { preferLocalBuild = true; extraOptions = cfg.extraOptions; }
          ''
            cat > $out <<END
            # WARNING: this file is generated from the nix.* options in
            # your NixOS configuration, typically
            # /etc/nixos/configuration.nix.  Do not edit it!
            ${optionalString cfg.useDaemon ''
              build-users-group = nixbld
            ''}
            max-jobs = ${toString cfg.settings.max-jobs}
            auto-optimise-store = ${if cfg.settings.auto-optimise-store then "true" else "false"}
            cores = ${toString cfg.settings.cores}
            sandbox = ${if (builtins.isBool cfg.settings.sandbox) then boolToString cfg.settings.sandbox else cfg.settings.sandbox}
            ${optionalString (cfg.settings.extra-sandbox-paths != []) ''
              extra-sandbox-paths = ${toString cfg.settings.extra-sandbox-paths}
            ''}
            substituters = ${toString cfg.settings.substituters}
            trusted-substituters = ${toString cfg.settings.trusted-substituters}
            trusted-public-keys = ${toString cfg.settings.trusted-public-keys}
            require-sigs = ${if cfg.settings.require-sigs then "true" else "false"}
            trusted-users = ${toString cfg.settings.trusted-users}
            allowed-users = ${toString cfg.settings.allowed-users}
            $extraOptions
            END
          '';
  
    legacyConfMappings = {
      useSandbox = "sandbox";
  
negative.code:           Named entries can be specified using an attribute set, if an
            entry is configured multiple times the value with the lowest
            ordering will be used.
          '';
        };
  
        checkConfig = mkOption {
          type = types.bool;
          default = true;
          description = ''
            If enabled (the default), checks for data type mismatches and that Nix
            can parse the generated nix.conf.
          '';
        };
  
  