anchor.diff:        { description = "chrony NTP daemon";
   
           wantedBy = [ "multi-user.target" ];
  -        wants = [ "time-sync.target" ];
  -        before = [ "time-sync.target" ];
  -        after = [ "network.target" ];
  +        wants    = [ "time-sync.target" ];
  +        before   = [ "time-sync.target" ];
  +        after    = [ "network.target" ];
           conflicts = [ "ntpd.service" "systemd-timesyncd.service" ];
   
           path = [ pkgs.chrony ];
   
  -        preStart =
  -          ''
  -            mkdir -m 0755 -p ${stateDir}
  -            touch ${keyFile}
  -            chmod 0640 ${keyFile}
  -            chown chrony:chrony ${stateDir} ${keyFile}
  -          '';
  +        preStart = ''
  +          mkdir -m 0755 -p ${stateDir}
  +          touch ${keyFile}
  +          chmod 0640 ${keyFile}
  +          chown chrony:chrony ${stateDir} ${keyFile}
  +        '';
   
           serviceConfig =
  -          { ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
  +          { Type = "forking";
  +            ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
  +
  +            ProtectHome = "yes";
  +            ProtectSystem = "full";
  +            PrivateTmp = "yes";
  +
  +            ConditionCapability = "CAP_SYS_TIME";
             };
         };
  -
     };
  -
   }
  
positive.code:         description = "Extra flags passed to the chronyd command.";
        };
      };
  
    };
  
  
    ###### implementation
  
    config = mkIf cfg.enable {
  
      # Make chronyc available in the system path
      environment.systemPackages = [ pkgs.chrony ];
  
      users.groups = singleton
  
negative.code:     ${cfg.extraConfig}
    '';
  
    chronyFlags = "-m -u chrony -f ${configFile} ${toString cfg.extraFlags}";
  in
  {
    options = {
      services.chrony = {
        enable = mkOption {
          default = false;
          description = ''
  