anchor.diff:        };
   
       };
  -
     };
   
   
     ###### implementation
   
  -  config = mkIf config.services.kerberos_server.enable {
  -
  -    environment.systemPackages = [ heimdalFull ];
  +  config = mkIf cfg.enable {
  +    environment.systemPackages = [ pkgs.heimdalFull ];
       systemd.services.kadmind = {
         description = "Kerberos Administration Daemon";
         script = "${pkgs.heimdalFull}/libexec/heimdal/kadmind";
  
positive.code:       preStart = ''
          mkdir -m 0755 -p ${stateDir}
        '';
        script = "${heimdalFull}/libexec/heimdal/kdc";
      };
  
      systemd.services.kpasswdd = {
        description = "Kerberos Password Changing daemon";
        wantedBy = [ "multi-user.target" ];
        script = "${heimdalFull}/libexec/heimdal/kpasswdd";
      };
    };
  }
  
negative.code: {pkgs, config, lib, ...}:
  
  let
    inherit (lib) mkOption mkIf;
    cfg = config.services.kerberos_server;
    stateDir = "/var/heimdal";
  in
  
  {
    ###### interface
    options = {
      services.kerberos_server = {
        enable = mkOption {
          default = false;
          description = ''
  