anchor.diff:          ProtectKernelTunables = true;
           ProtectControlGroups = true;
           RestrictAddressFamilies =
  -          optionals (conf.bind != null) ["AF_INET" "AF_INET6"] ++
  +          optionals (conf.port != 0) ["AF_INET" "AF_INET6"] ++
             optional (conf.unixSocket != null) "AF_UNIX";
           RestrictNamespaces = true;
           LockPersonality = true;
  
positive.code: 
              bind = mkOption {
                type = with types; nullOr str;
                default = if name == "" then "127.0.0.1" else null;
                defaultText = literalExpression ''if name == "" then "127.0.0.1" else null'';
                description = ''
                  The IP interface to bind to.
                  <literal>null</literal> means "all interfaces".
  
negative.code:             unixSocket = mkOption {
                type = with types; nullOr path;
                default = "/run/${redisName name}/redis.sock";
                defaultText = literalExpression ''
                  if name == "" then "/run/redis/redis.sock" else "/run/redis-''${name}/redis.sock"
                '';
                description = "The path to the socket to bind to.";
              };
  
  