anchor.diff:        };
   
         buildMachines = mkOption {
  -        type = types.loaOf (submodule ({ config }: {
  +        type = types.listOf (types.submodule ({
             options = {
  +            hostName = mkOption {
  +              type = types.str;
  +              example = "nixbuilder.example.org";
  +              description = ''
  +                The hostname of the build machine.
  +              '';
  +            };
  +            system = mkOption {
  +              type = types.nullOr types.str;
  +              default = null;
  +              example = "x86_64-linux";
  +              description = ''
  +                The system type the build machine can execute derivations on.
  +                Either this attribute or <varname>systems</varname> must be
  +                present, where <varname>system</varname> takes precedence if
  +                both are set.
  +              '';
  +            };
  +            systems = mkOption {
  +              type = types.listOf types.str;
  +              default = [];
  +              example = [ "x86_64-linux" "aarch64-linux" ];
  +              description = ''
  +                The system types the build machine can execute derivations on.
  +                Either this attribute or <varname>system</varname> must be
  +                present, where <varname>system</varname> takes precedence if
  +                both are set.
  +              '';
  +            };
               sshUser = mkOption {
  -              type = types.nullOr types.string;
  +              type = types.nullOr types.str;
                 default = null;
  -              description = ''
  -                The user as who to SSH to the build machine.
  -              '';
  -            };
  -            hostName = mkOption {
  -              type = types.string;
  -              description = ''
  -                The hostname of the build machine.
  -              '';
  -            };
  -            system = mkOption {
  -              type = types.string;
  +              example = "builder";
  +              description = ''
  +                The username to log in as on the remote host. This user must be
  +                able to log in and run nix commands non-interactively. It must
  +                also be privileged to build derivations, so must be included in
  +                <option>nix.trustedUsers</option>.
  +              '';
  +            };
  +            sshKey = mkOption {
  +              type = types.nullOr types.str;
                 default = null;
  -              description = ''
  -                The system type the build machine can execute derivations on.
  -                null if multiple are supported.
  -              '';
  -            };
  -            systems = mkOption {
  -              type = types.listOf types.string;
  -              default = [];
  -              description = ''
  -                The system types the build machine can execute derivations on.
  -              '';
  -            };
  -            sshKey = mkOption {
  -              type = types.string;
  -              default = "-";
  -              description = ''
  -                The path to the SSH private key with which to authenticate with
  -                the build machine. <literal>"-"</literal> indicates falling back
  -                on defaults.
  +              example = "/root/.ssh/id_buildhost_builduser";
  +              description = ''
  +                The path to the SSH private key with which to authenticate on
  +                the build machine. The private key must not have a passphrase.
  +                If null, the building user (root on NixOS machines) must have an
  +                appropriate ssh configuration to log in non-interactively.
  +
  +                Note that for security reasons, this path must point to a file
  +                in the local filesystem, *not* to the nix store.
                 '';
               };
               maxJobs = mkOption {
  
positive.code:               default = 1;
                description = ''
                  The number of concurrent jobs the build machine supports. The
                  build machine will enforce its own limits but this allows hydra
                  to schedule better since there is no work-stealing between build
                  machines.
                '';
  
negative.code:           concatMapStrings (machine:
              "${if machine.sshUser != null then "${machine.sshUser}@" else ""}${machine.hostName} "
              + (if machine.system != null then machine.system else concatStringsSep "," machine.systems)
              + " ${if machine.sshKey != null then machine.sshKey else "-"} ${toString machine.maxJobs} "
              + toString (machine.speedFactor)
              + " "
              + concatStringsSep "," (machine.mandatoryFeatures ++ machine.supportedFeatures)
  