anchor.diff:  
               mkdir -m 0755 -p /etc/ssh
   
  -            if ! test -f /etc/ssh/ssh_host_dsa_key; then
  -                ${pkgs.openssh}/bin/ssh-keygen -t dsa -b 1024 -f /etc/ssh/ssh_host_dsa_key -N ""
  +            if ! test -f /etc/ssh/ssh_host_${hktn}_key; then
  +                ${pkgs.openssh}/bin/ssh-keygen -t ${hktn} -b ${toString hktb} -f /etc/ssh/ssh_host_${hktn}_key -N ""
               fi
             '';
   
  
positive.code:         '';
        };
  
        extraConfig = mkOption {
          default = "";
          description = "Verbatim contents of <filename>sshd_config</filename>.";
  
negative.code:     v == "without-password" ||
      v == "forced-commands-only" ||
      v == "no";
  
    hostKeyTypeNames = {
      dsa1024  = "dsa";
      rsa1024  = "rsa";
      ecdsa521 = "ecdsa";
    };
  
    hostKeyTypeBits = {
      dsa1024  = 1024;
      rsa1024  = 1024;
      ecdsa521 = 521;
    };
  
    hktn = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeNames;
    hktb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeBits;
  
    userOptions = {
      openssh.authorizedKeys = {
  