anchor.diff:  
     ###### implementation
   
  -  config = mkIf config.services.openssh.enable {
  +  config = mkIf cfg.enable {
   
       users.extraUsers = singleton
         { name = "sshd";
  
positive.code:           ''
              mkdir -m 0755 -p /etc/ssh
  
              if ! test -f ${cfg.hostKeyPath}; then
                  ssh-keygen -t ${hktn} -b ${toString hktb} -f ${cfg.hostKeyPath} -N ""
              fi
  
              result=$(ssh-keygen -lf ${cfg.hostKeyPath}|awk '{ print ($1>=${toString hktsb}?1:0)}')
              if [ "$result" -ne "1" ]; then
                ERROR="SECURITY ALERT: SSH Host Key is too weak. Generate a strong key NOW."
                echo "$ERROR"
                echo "$ERROR" > /dev/console
              fi
            '';
  
          serviceConfig =
            { ExecStart =
                "${pkgs.openssh}/sbin/sshd -h ${cfg.hostKeyPath} " +
                "-f ${pkgs.writeText "sshd_config" cfg.extraConfig}";
              Restart = "always";
              Type = "forking";
  
negative.code:         PrintMotd no # handled by pam_motd
  
          AuthorizedKeysFile ${toString cfg.authorizedKeysFiles}
  
          ${flip concatMapStrings cfg.hostKeys (k: ''
            HostKey ${k.path}
          '')}
        '';
  
      assertions = [{ assertion = if cfg.forwardX11 then cfgc.setXAuthLocation else true;
  