anchor.diff:    config = mkIf cfg.enable {
       environment.etc."nscd.conf".text = cfg.config;
   
  +    users.users.${cfg.user} = {
  +      isSystemUser = true;
  +      group = cfg.group;
  +    };
  +
  +    users.groups.${cfg.group} = {};
  +
       systemd.services.nscd =
         { description = "Name Service Cache Daemon";
   
  
positive.code:           config.environment.etc."nscd.conf".source
          ];
  
          # We use DynamicUser because in default configurations nscd doesn't
          # create any files that need to survive restarts. However, in some
          # configurations, nscd needs to be started as root; it will drop
          # privileges after all the NSS modules have read their configuration
          # files. So prefix the ExecStart command with "!" to prevent systemd
          # from dropping privileges early. See ExecStart in systemd.service(5).
          serviceConfig =
            { ExecStart = "!@${cfg.package}/bin/nscd nscd";
              Type = "forking";
              DynamicUser = true;
              RuntimeDirectory = "nscd";
              PIDFile = "/run/nscd/nscd.pid";
              Restart = "always";
  
negative.code:           Whether to enable the Name Service Cache Daemon.
            Disabling this is strongly discouraged, as this effectively disables NSS Lookups
            from all non-glibc NSS modules, including the ones provided by systemd.
          '';
        };
  
        user = mkOption {
          type = types.str;
          default = "nscd";
          description = ''
            User account under which nscd runs.
          '';
        };
  
        group = mkOption {
          type = types.str;
          default = "nscd";
          description = ''
            User group under which nscd runs.
          '';
        };
  
  