anchor.diff:        { assertion = !dynamicHostsEnabled || (dynamicHostsEnabled && cfg.dns == "dnsmasq");
           message = ''
             To use networking.networkmanager.dynamicHosts you also need to set
  -          networking.networkmanager.dns = "dnsmasq"
  +          `networking.networkmanager.dns = "dnsmasq"`
           '';
         }
       ];
  
positive.code:     networkmanager-openconnect
      networkmanager-openvpn
      networkmanager-vpnc
     ] ++ optional (!delegateWireless) wpa_supplicant;
  
    dynamicHostsEnabled =
      cfg.dynamicHosts.enable && cfg.dynamicHosts.hostsDirs != {};
  
    delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [];
  
    # /var/lib/misc is for dnsmasq.leases.
    stateDirs = "/var/lib/NetworkManager /var/lib/dhclient /var/lib/misc";
  
negative.code:       wireless.enable = mkDefault false;
      }) // (mkIf cfg.enableStrongSwan {
        networkmanager.packages = [ pkgs.networkmanager_strongswan ];
      }) // (mkIf enableIwd {
        wireless.iwd.enable = true;
      });
  
      security.polkit.extraConfig = polkitConf;
  