anchor.diff: -{pkgs, config, ...}:
  +{ config, pkgs, ... }:
  +
  +with pkgs.lib;
   
   let
   
  -  inherit (pkgs.lib) mkOption mkIf;
     inherit (pkgs) openssh;
   
     cfg = config.services.sshd;
  
positive.code: 
    config = mkIf config.services.sshd.enable {
  
      users.extraUsers = pkgs.lib.singleton
        { name = "sshd";
          uid = config.ids.uids.sshd;
          description = "SSH privilege separation user";
          home = "/var/empty";
        };
  
      jobs.sshd = {
  
negative.code:         exec = "${openssh}/sbin/sshd -h /etc/ssh/ssh_host_dsa_key -f ${sshdConfig}";
        };
  
      networking.firewall.allowedTCPPorts = cfg.ports;
            
    };
  
  