anchor.diff:    # refrain ourselves from providing a footgun.
     checkWireGuard = checkUnitConfig "WireGuard" [
       (assertOnlyFields [
  -      "PrivateKeyFile" "ListenPort" "FwMark"
  +      "PrivateKeyFile"
  +      "ListenPort"
  +      "FwMark"
       ])
       # The following check won't work on nix <= 2.2
       # see https://github.com/NixOS/nix/pull/2378
  
positive.code:   ];
  
    checkPeer = checkUnitConfig "Peer" [
      (assertOnlyFields ["Name" "MACAddress"])
      (assertMacAddress "MACAddress")
    ];
  
    tunTapChecks = [
      (assertOnlyFields ["OneQueue" "MultiQueue" "PacketInfo" "VNetHeader" "User" "Group"])
      (assertValueOneOf "OneQueue" boolValues)
      (assertValueOneOf "MultiQueue" boolValues)
      (assertValueOneOf "PacketInfo" boolValues)
  
negative.code: 
    checkNetwork = checkUnitConfig "Network" [
      (assertOnlyFields [
        "Description"
        "DHCP"
        "DHCPServer"
        "LinkLocalAddressing"
        "IPv4LLRoute"
        "IPv6Token"
        "LLMNR"
        "MulticastDNS"
        "DNSOverTLS"
        "DNSSEC"
        "DNSSECNegativeTrustAnchors"
        "LLDP"
        "EmitLLDP"
        "BindCarrier"
        "Address"
        "Gateway"
        "DNS"
        "Domains"
        "NTP"
        "IPForward"
        "IPMasquerade"
        "IPv6PrivacyExtensions"
        "IPv6AcceptRA"
        "IPv6DuplicateAddressDetection"
        "IPv6HopLimit"
        "IPv4ProxyARP"
        "IPv6ProxyNDP"
        "IPv6ProxyNDPAddress"
        "IPv6PrefixDelegation"
        "IPv6MTUBytes"
        "Bridge"
        "Bond"
        "VRF"
        "VLAN"
        "IPVLAN"
        "MACVLAN"
        "VXLAN"
        "Tunnel"
        "ActiveSlave"
        "PrimarySlave"
        "ConfigureWithoutCarrier"
        "Xfrm"
        "KeepConfiguration"
      ])
      # Note: For DHCP the values both, none, v4, v6 are deprecated
      (assertValueOneOf "DHCP" ["yes" "no" "ipv4" "ipv6" "both" "none" "v4" "v6"])
  