anchor.diff:              allowed-users = mkOption {
                 type = types.listOf types.str;
                 default = [ "*" ];
  -              example = [ "@wheel" "@builders" "alice" "bob" ];
  +              example = [ "@admin" "@builders" "alice" "bob" ];
                 description = ''
                   A list of names of users (separated by whitespace) that are
                   allowed to connect to the Nix daemon. As with
  
positive.code:           };
          };
          default = { };
          example = literalExpression ''
            {
              use-sandbox = true;
              show-trace = true;
  
              system-features = [ "big-parallel" "kvm" "recursive-nix" ];
              sandbox-paths = { "/bin/sh" = "''${pkgs.busybox-sandbox-shell.out}/bin/busybox"; };
            }
          '';
          description = ''
            Configuration for Nix, see
            <link xlink:href="https://nixos.org/manual/nix/stable/#sec-conf-file"/> or
            <citerefentry>
              <refentrytitle>nix.conf</refentrytitle>
              <manvolnum>5</manvolnum>
            </citerefentry> for avalaible options.
            The value declared here will be translated directly to the key-value pairs Nix expects.
            </para>
            <para>
            You can use <command>nix-instantiate --eval --strict '&lt;nixpkgs/nixos&gt;' -A config.nix.settings</command>
            to view the current value. By default it is empty.
            </para>
            <para>
            Nix configurations defined under <option>nix.*</option> will be translated and applied to this
  
negative.code:                 If set, Nix will perform builds in a sandboxed environment that it
                  will set up automatically for each build. This prevents impurities
                  in builds by disallowing access to dependencies outside of the Nix
                  store by using network and mount namespaces in a chroot environment. It
                  doesn't affect derivation hashes, so changing this option will not
                  trigger a rebuild of packages.
                '';
  