anchor.diff:    services.openssh.permitRootLogin = "prohibit-password";
     services.openssh.passwordAuthentication = mkDefault false;
   
  +  # Use GCE udev rules for dynamic disk volumes
  +  services.udev.packages = [ gce ];
  +
     # Force getting the hostname from Google Compute.
     networking.hostName = mkDefault "";
   
     # Always include cryptsetup so that NixOps can use it.
     environment.systemPackages = [ pkgs.cryptsetup ];
  +
  +  # Rely on GCP's firewall instead
  +  networking.firewall.enable = mkDefault false;
   
     # Configure default metadata hostnames
     networking.extraHosts = ''
  
positive.code:     # randomizes addresses of mmap base, heap, stack and VDSO page
      "kernel.randomize_va_space" = mkDefault "2";
  
      # provides protection from ToCToU races
      "fs.protected_hardlinks" = mkDefault "1";
  
  
negative.code: 
    networking.usePredictableInterfaceNames = false;
  
    # allow the google-accounts-daemon to manage users
    users.mutableUsers = true;
    # and allow users to sudo without password
    security.sudo.enable = true;
    security.sudo.extraConfig = ''
    %google-sudoers ALL=(ALL:ALL) NOPASSWD:ALL
    '';
  
    # NOTE: google-accounts tries to write to /etc/sudoers.d but the folder doesn't exist
    # FIXME: not such file or directory on dynamic SSH provisioning
    systemd.services.google-accounts-daemon = {
      description = "Google Compute Engine Accounts Daemon";
      # This daemon creates dynamic users
      enable = config.users.mutableUsers;
      after = [
        "network.target"
        "google-instance-setup.service"
        "google-network-setup.service"
      ];
      wantedBy = [ "multi-user.target" ];
      requires = ["network.target"];
      path = with pkgs; [ shadow ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${gce}/bin/google_accounts_daemon --debug";
      };
    };
  
    systemd.services.google-clock-skew-daemon = {
      description = "Google Compute Engine Clock Skew Daemon";
      after = [
        "network.target"
        "google-instance-setup.service"
        "google-network-setup.service"
      ];
      requires = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${gce}/bin/google_clock_skew_daemon --debug";
      };
    };
  
    systemd.services.google-instance-setup = {
      description = "Google Compute Engine Instance Setup";
      after = ["fs.target" "network-online.target" "network.target" "rsyslog.service"];
      before = ["sshd.service"];
      wants = ["local-fs.target" "network-online.target" "network.target"];
      wantedBy = [ "sshd.service" "multi-user.target" ];
      path = with pkgs; [ ethtool ];
      serviceConfig = {
        ExecStart = "${gce}/bin/google_instance_setup --debug";
        Type = "oneshot";
      };
    };
  
    systemd.services.google-ip-forwarding-daemon = {
      description = "Google Compute Engine IP Forwarding Daemon";
      after = ["network.target" "google-instance-setup.service" "google-network-setup.service"];
      requires = ["network.target"];
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [ iproute ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${gce}/bin/google_ip_forwarding_daemon --debug";
      };
    };
  
    systemd.services.google-shutdown-scripts = {
      description = "Google Compute Engine Shutdown Scripts";
      after = [
        "local-fs.target"
        "network-online.target"
        "network.target"
        "rsyslog.service"
        "google-instance-setup.service"
        "google-network-setup.service"
      ];
      wants = [ "local-fs.target" "network-online.target" "network.target"];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${pkgs.coreutils}/bin/true";
        ExecStop = "${gce}/bin/google_metadata_script_runner --debug --script-type shutdown";
        Type = "oneshot";
        RemainAfterExit = true;
        TimeoutStopSec = 0;
      };
    };
  
    systemd.services.google-network-setup = {
      description = "Google Compute Engine Network Setup";
      after = [
        "local-fs.target"
        "network-online.target"
        "network.target"
        "rsyslog.service"
      ];
      wants = [ "local-fs.target" "network-online.target" "network.target"];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${gce}/bin/google_network_setup --debug";
        KillMode = "process";
        Type = "oneshot";
      };
    };
  
    systemd.services.google-startup-scripts = {
      description = "Google Compute Engine Startup Scripts";
      after = [
        "local-fs.target"
        "network-online.target"
        "network.target"
        "rsyslog.service"
        "google-instance-setup.service"
        "google-network-setup.service"
      ];
      wants = [ "local-fs.target" "network-online.target" "network.target"];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
        ExecStart = "${gce}/bin/google_metadata_script_runner --debug --script-type startup";
        KillMode = "process";
        Type = "oneshot";
      };
    };
  
    # TODO: remove this
    systemd.services.fetch-ssh-keys =
      { description = "Fetch host keys and authorized_keys for root user";
  
  