anchor.diff:    };
   
     nixpkgs = { config = { allowUnfree = true; }; };
  -
  -  security = { hideProcessInformation = true; };
   
     services = {
       cron = {
  
positive.code:         iptables -A INPUT -p udp -s 10.0.0.0/8 --dport ${toString dnsmasq_port} -m udp -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString (builtins.head config.services.openssh.ports)} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString config.services.kibana.port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
  
          iptables -A INPUT -p udp -s ${ip_nas}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_pine}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_raspi4}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
          iptables -A INPUT -p udp -s ${ip_ux305c}/32 --dport ${toString syslog_port} -m udp -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_nas}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_pine}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_raspi4}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString syslog_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
  
          iptables -A INPUT -p tcp -s ${ip_pine}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_raspi4}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
          iptables -A INPUT -p tcp -s ${ip_ux305c}/32 --dport ${toString beats_port} -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
        '';
      };
  
  
negative.code:   ip_raspi4 = "10.0.10.38";
    ip_ux305c = "10.0.10.3";
  in {
    imports = [ ./6910p-hardware.nix ./6910p-secrets.nix ./extras/6910p-dhcp.nix ];
  
    boot = {
      cleanTmpDir = true;
  