anchor.diff:        wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         partOf = optional config.networking.firewall.enable "firewall.service";
  +
  +      restartTriggers = [ configFile ];
   
         path = with pkgs; if config.networking.nftables.enable
           then [ nftables iproute2 systemd ]
  
positive.code: 
    config = mkIf cfg.enable {
  
      environment.etc."sshguard.conf".text = let
        args = lib.concatStringsSep " " ([
          "-afb"
          "-p info"
          "-o cat"
          "-n1"
        ] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
        backend = if config.networking.nftables.enable
          then "sshg-fw-nft-sets"
          else "sshg-fw-ipset";
      in ''
        BACKEND="${pkgs.sshguard}/libexec/${backend}"
        LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
      '';
  
      systemd.services.sshguard = {
        description = "SSHGuard brute-force attacks protection system";
  
negative.code: 
  let
    cfg = config.services.sshguard;
  
    configFile = let
      args = lib.concatStringsSep " " ([
        "-afb"
        "-p info"
        "-o cat"
        "-n1"
      ] ++ (map (name: "-t ${escapeShellArg name}") cfg.services));
      backend = if config.networking.nftables.enable
        then "sshg-fw-nft-sets"
        else "sshg-fw-ipset";
    in pkgs.writeText "sshguard.conf" ''
      BACKEND="${pkgs.sshguard}/libexec/${backend}"
      LOGREADER="LANG=C ${pkgs.systemd}/bin/journalctl ${args}"
    '';
  
  in {
  
  