anchor.diff:      (assertMacAddress "MACAddress")
     ];
   
  +  checkWireGuard = checkUnitConfig "WireGuard" [
  +    (assertOnlyFields [
  +      "PrivateKey" "PrivateKeyFile" "ListenPort" "FwMark"
  +    ])
  +    #(assertRange "ListenPort" 1 65535) # Or "auto"
  +  ];
  +
  +  checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [
  +    (assertOnlyFields [
  +      "PublicKey" "PresharedKey" "AllowedIPs" "Endpoint" "PersistentKeepalive"
  +    ])
  +    # (assertRange "PersistentKeepalive" 1 65535) # defined as "nullOr int"
  +  ];
  +
     checkVlan = checkUnitConfig "VLAN" [
       (assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
       (assertRange "Id" 0 4094)
  
positive.code:     };
    };
  
    networkOptions = commonNetworkOptions // {
  
      networkConfig = mkOption {
  
negative.code:       '';
      };
  
      wireguardConfig = mkOption {
        default = {};
        example = { ListenPort="auto"; };
        type = types.addCheck (types.attrsOf unitOption) checkWireGuard;
        description = ''
          Each attribute in this set specifies an option in the
          <literal>[WireGuard]</literal> section of the unit.  See
          <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
          <manvolnum>5</manvolnum></citerefentry> for details.
        '';
      };
  
      wireguardPeers = mkOption {
        default = [ ];
        type = with types; listOf (submodule wireguardPeerOptions);
        description = ''
          Each attribute in this set specifies an option in the
          <literal>[WireGuardPeer]</literal> section of the unit.  See
          <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
          <manvolnum>5</manvolnum></citerefentry> for details.
        '';
      };
  
      vlanConfig = mkOption {
        default = {};
        example = { Id = "4"; };
  