anchor.diff:    };
   
     config = {
  +    assertions = [
  +      {
  +        # generic catch if the NixOS module adding to nssModules does not prevent it with specific message.
  +        assertion = config.system.nssModules.path != "" -> canLoadExternalModules;
  +        message = "Loading NSS modules from path ${config.system.nssModules.path} requires nscd being enabled.";
  +      }
  +      {
  +        # resolved does not need to add to nssModules, therefore needs an extra assertion
  +        assertion = resolved -> canLoadExternalModules;
  +        message = "Loading systemd-resolved's nss-resolve NSS module requires nscd being enabled.";
  +      }
  +    ];
   
       # Name Service Switch configuration file.  Required by the C
       # library.  !!! Factor out the mdns stuff.  The avahi module
  
positive.code:   ldap = (config.users.ldap.enable && config.users.ldap.nsswitch);
    sssd = config.services.sssd.enable;
    resolved = config.services.resolved.enable;
  
    hostArray = [ "files" "mymachines" ]
      ++ optionals nssmdns [ "mdns_minimal [!UNAVAIL=return]" ]
  
negative.code:   options = {
  
      # NSS modules.  Hacky!
      # Only works with nscd!
      system.nssModules = mkOption {
        type = types.listOf types.path;
        internal = true;
  