anchor.diff:    };
   
     config = mkIf cfg.enable {
  -    users.extraGroups.cfssl = {
  +    users.groups.cfssl = {
         gid = config.ids.gids.cfssl;
       };
   
  -    users.extraUsers.cfssl = {
  +    users.users.cfssl = {
         description = "cfssl user";
         home = cfg.dataDir;
         group = "cfssl";
  
positive.code: 
      port = mkOption {
        default = 8888;
        type = types.ints.u16;
        description = "Port to bind.";
      };
  
  
negative.code:           WorkingDirectory = cfg.dataDir;
            Restart = "always";
            User = "cfssl";
            Group = "cfssl";
  
            ExecStart = with cfg; let
              opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
  