anchor.diff:          home = "/var/empty";
         };
   
  -    environment.etc = [
  +    environment.etc = authKeysFiles ++ [
         { source = "${pkgs.openssh}/etc/ssh/moduli";
           target = "ssh/moduli";
         }
  
positive.code: 
    userOptions = {
      openssh.authorizedKeys = {
  
        preserveExistingKeys = mkOption {
          type = types.bool;
          default = true;
          description = ''
            If this option is enabled, the keys specified in
            <literal>keys</literal> and/or <literal>keyFiles</literal> will be
            placed in a special section of the user's authorized_keys file
            and any existing keys will be preserved. That section will be
            regenerated each time NixOS is activated. However, if
            <literal>preserveExisting</literal> isn't enabled, the complete file
            will be generated, and any user modifications will be wiped out.
          '';
        };
  
        keys = mkOption {
          type = types.listOf types.string;
          default = [];
          description = ''
            A list of verbatim OpenSSH public keys that should be inserted into the
            user's authorized_keys file. You can combine the <literal>keys</literal> and
            <literal>keyFiles</literal> options.
          '';
        };
  
        keyFiles = mkOption {
          #type = types.listOf types.string;
          default = [];
          description = ''
            A list of files each containing one OpenSSH public keys that should be
            inserted into the user's authorized_keys file. You can combine
            the <literal>keyFiles</literal> and
            <literal>keys</literal> options.
          '';
        };
  
      };
    };
  
    mkAuthkeyScript =
      let
        marker1 = "### NixOS auto-added key. Do not edit!";
        marker2 = "### NixOS will regenerate this file. Do not edit!";
        users = map (userName: getAttr userName config.users.extraUsers) (attrNames config.users.extraUsers);
        usersWithKeys = flip filter users (u:
          length u.openssh.authorizedKeys.keys != 0 || length u.openssh.authorizedKeys.keyFiles != 0
        );
        userLoop = flip concatMapStrings usersWithKeys (u:
          let
            authKeys = concatStringsSep "," u.openssh.authorizedKeys.keys;
            authKeyFiles = concatStrings (map (x: " ${x}") u.openssh.authorizedKeys.keyFiles);
            preserveExisting = if u.openssh.authorizedKeys.preserveExistingKeys then "true" else "false";
          in ''
            mkAuthKeysFile "${u.name}" "${authKeys}" "${authKeyFiles}" "${preserveExisting}"
          ''
        );
      in ''
        mkAuthKeysFile() {
          local userName="$1"
          local authKeys="$2"
          local authKeyFiles="$3"
          local preserveExisting="$4"
  
          eval homeDir=~$userName
          if ! [ -d "$homeDir" ]; then
            echo "User $userName does not exist"
            return
          fi
          if ! [ -d "$homeDir/.ssh" ]; then
            mkdir -v -m 700 "$homeDir/.ssh"
            chown "$userName":users "$homeDir/.ssh"
          fi
          local authKeysFile="$homeDir/.ssh/authorized_keys"
          touch "$authKeysFile"
          if [ "$preserveExisting" == false ]; then
            rm -f "$authKeysFile"
            echo "${marker2}" > "$authKeysFile"
          else
            sed -i '/${marker1}/ d' "$authKeysFile"
          fi
          IFS=,
          for f in $authKeys; do
            echo "$f ${marker1}" >> "$authKeysFile"
          done
          unset IFS
          for f in $authKeyFiles; do
            if [ -f "$f" ]; then
              echo "$(cat "$f") ${marker1}" >> "$authKeysFile"
            fi
          done
          chown "$userName" "$authKeysFile"
        }
  
        ${userLoop}
      '';
  
  
  in
  
  
negative.code:           LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
          };
  
          path = [ pkgs.openssh ];
  
          preStart =
            ''
              mkdir -m 0755 -p /etc/ssh
  
              if ! test -f ${cfg.hostKeyPath}; then
  