anchor.diff:  
           exec =
             ''
  -            ${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key \
  +            ${pkgs.openssh}/sbin/sshd -h /etc/ssh/ssh_host_${hktn}_key \
                 -f ${pkgs.writeText "sshd_config" cfg.extraConfig}
             '';
         };
  
positive.code:         '';
        };
  
        extraConfig = mkOption {
          default = "";
          description = "Verbatim contents of <filename>sshd_config</filename>.";
  
negative.code:     v == "without-password" ||
      v == "forced-commands-only" ||
      v == "no";
  
    hostKeyTypeNames = {
      dsa1024  = "dsa";
      rsa1024  = "rsa";
      ecdsa521 = "ecdsa";
    };
  
    hostKeyTypeBits = {
      dsa1024  = 1024;
      rsa1024  = 1024;
      ecdsa521 = 521;
    };
  
    hktn = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeNames;
    hktb = attrByPath [cfg.hostKeyType] (throw "unknown host key type `${cfg.hostKeyType}'") hostKeyTypeBits;
  
    userOptions = {
      openssh.authorizedKeys = {
  