anchor.diff:  
   let
     cfg = config.services.sshguard;
  +
  +  configFile = let
  +    args = lib.concatStringsSep " " ([
  +      "-afb"
  +      "-p info"
  +      "-o cat"
  +      "-n1"
  +    ] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
  +    backend = if config.networking.nftables.enable
  +      then "sshg-fw-nft-sets"
  +      else "sshg-fw-ipset";
  +  in pkgs.writeText "sshguard.conf" ''
  +    BACKEND="${pkgs.sshguard}/libexec/${backend}"
  +    LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
  +  '';
   
   in {
   
  
positive.code:       wantedBy = [ "multi-user.target" ];
        after = [ "network.target" ];
        partOf = optional config.networking.firewall.enable "firewall.service";
  
        path = with pkgs; if config.networking.nftables.enable
          then [ nftables iproute2 systemd ]
  
negative.code: 
    config = mkIf cfg.enable {
  
      environment.etc."sshguard.conf".source = configFile;
  
      systemd.services.sshguard = {
        description = "SSHGuard brute-force attacks protection system";
  