anchor.diff:        servers = [ "127.0.0.1#5300" ];
       };
   
  -    elasticsearch = {
  -      enable = true;
  -      extraConf = ''
  -        # Apply manually, see https://github.com/elastic/elasticsearch/issues/40803
  -        cluster.max_shards_per_node: 100000
  -        node.name: "elasticsearch"
  -        node.master: true
  -        node.data: true
  -      '';
  -      package = pkgs.elasticsearch7-oss;
  -    };
  -
  -    elasticsearch-curator = {
  -      actionYAML = ''
  -        ---
  -        actions:
  -          1:
  -            action: delete_indices
  -            options:
  -              allow_ilm_indices: true
  -              ignore_empty_list: True
  -              disable_action: False
  -            filters:
  -            - filtertype: pattern
  -              kind: prefix
  -              value: nequi-
  -            - filtertype: age
  -              source: name
  -              direction: older
  -              timestring: '%Y.%m.%d'
  -              unit: days
  -              unit_count: 30
  -      '';
  -      enable = true;
  -    };
  -
  -    journalbeat = {
  -      enable = true;
  -      extraConfig = ''
  -        logging.metrics.enabled: false
  -
  -        journalbeat.inputs:
  -          - paths: []
  -
  -        output.elasticsearch:
  -          hosts: ["http://localhost:${toString config.services.elasticsearch.port}"]
  -      '';
  -      package = pkgs.journalbeat7;
  -    };
  -
  -    kibana = {
  -      elasticsearch.hosts = [ "http://localhost:${toString config.services.elasticsearch.port}" ];
  -      enable = true;
  -      listenAddress = "0.0.0.0";
  -      package = pkgs.kibana7-oss;
  -    };
  -
       locate.enable = true;
   
       logind.extraConfig = "HandleLidSwitch=ignore";
  -
  -    logstash = {
  -      enable = true;
  -
  -      inputConfig = ''
  -        syslog {
  -          port => ${toString syslog_port}
  -          type => syslog
  -        }
  -        beats {
  -          port => ${toString beats_port}
  -        }
  -      '';
  -
  -      filterConfig = ''
  -        if [@metadata][beat] {
  -          mutate { remove_field => [ "type" ] }
  -          mutate { add_field => { "type" => "%{[@metadata][beat]}-%{[@metadata][version]}" } }
  -        }
  -      '';
  -
  -      outputConfig = ''
  -        elasticsearch {
  -          hosts => ["localhost:${toString config.services.elasticsearch.port}"]
  -          index => "%{type}-%{+YYYY.MM.dd}"
  -        }
  -      '';
  -
  -      package = pkgs.logstash7-oss;
  -    };
   
       ntp = {
         enable = true;
  
positive.code:         iptables -A INPUT -p udp -s 10.0.0.0/8 --dport ${toString dnsmasq_port} -m udp -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString (builtins.head config.services.openssh.ports)} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString config.services.kibana.port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
  
          iptables -A INPUT -p udp -s ${ip_nas}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_pine}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_raspi4}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_ux305c}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_nas}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_pine}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_raspi4}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_pine}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_raspi4}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
        '';
      };
  
  
negative.code:       "https://s3.amazonaws.com/lists.disconnect.me/simple_ad.txt";
      disconnectme_tracking =
        "https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt";
      notracking =
        "https://raw.githubusercontent.com/notracking/hosts-blocklists/master/hostnames.txt";
      steven_black =
        "https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/fakenews-gambling-porn/hosts";
    };
  
    ip_router = "10.0.0.2";
    ip_ap = "10.0.0.3";
  