anchor.diff:            The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
           '';
         })) ++ (forEach interfaces (i: {
  -        assertion = i.preferTempAddress -> cfg.enableIPv6;
  +        assertion = i.tempAddress != "disabled" -> cfg.enableIPv6;
           message = ''
             Temporary addresses are only needed when IPv6 is enabled.
           '';
  
positive.code:         description = "Name of the interface.";
        };
  
        preferTempAddress = mkOption {
          type = types.bool;
          default = cfg.enableIPv6;
          defaultText = literalExample "config.networking.enableIPv6";
          description = ''
            When using SLAAC prefer a temporary (IPv6) address over the EUI-64
            address for originating connections. This is used to reduce tracking.
          '';
        };
  
  
negative.code:       (pkgs.writeTextFile rec {
          name = "ipv6-privacy-extensions.rules";
          destination = "/etc/udev/rules.d/99-${name}";
          text = concatMapStrings (i:
            let
              opt = i.tempAddress;
              val = if opt == "disabled" then 0 else 1;
              msg = if opt == "disabled"
                    then "completely disable IPv6 privacy addresses"
                    else "enable IPv6 privacy addresses but prefer EUI-64 addresses";
            in
            ''
              # override to ${msg} for ${i.name}
              ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${toString val}"
            '') (filter (i: i.tempAddress != "default") interfaces);
        })
      ] ++ lib.optional (cfg.wlanInterfaces != {})
        (pkgs.writeTextFile {
  