anchor.diff:        description = "Virtual machine lock manager";
         serviceConfig.ExecStart = "@${pkgs.libvirt}/sbin/virtlockd virtlockd";
       };
  -
  -    users.extraGroups.libvirtd.gid = config.ids.gids.libvirtd;
  -
     };
   }
  
positive.code: # Systemd services for libvirtd.
  
  { config, lib, pkgs, ... }:
  
  with lib;
  
negative.code: 
      boot.kernelModules = [ "tun" ];
  
      users.extraGroups.libvirtd.gid = config.ids.gids.libvirtd;
  
      systemd.services.libvirtd = {
        description = "Libvirt Virtual Machine Management Daemon";
  
        wantedBy = [ "multi-user.target" ];
        after = [ "systemd-udev-settle.service" ]
                ++ optional vswitch.enable "vswitchd.service";
  
        path = [
            pkgs.bridge-utils
            pkgs.dmidecode
            pkgs.dnsmasq
            pkgs.ebtables
          ]
          ++ optional cfg.enableKVM pkgs.qemu_kvm
          ++ optional vswitch.enable vswitch.package;
  
        preStart = ''
          mkdir -p /var/log/libvirt/qemu -m 755
          rm -f /var/run/libvirtd.pid
  
          mkdir -p /var/lib/libvirt
          mkdir -p /var/lib/libvirt/dnsmasq
  
          chmod 755 /var/lib/libvirt
          chmod 755 /var/lib/libvirt/dnsmasq
  
          # Copy default libvirt network config .xml files to /var/lib
          # Files modified by the user will not be overwritten
          for i in $(cd ${pkgs.libvirt}/var/lib && echo \
              libvirt/qemu/networks/*.xml libvirt/qemu/networks/autostart/*.xml \
              libvirt/nwfilter/*.xml );
          do
              mkdir -p /var/lib/$(dirname $i) -m 755
              cp -npd ${pkgs.libvirt}/var/lib/$i /var/lib/$i
          done
  
          # libvirtd puts the full path of the emulator binary in the machine
          # config file. But this path can unfortunately be garbage collected
          # while still being used by the virtual machine. So update the
          # emulator path on each startup to something valid (re-scan $PATH).
          for file in /etc/libvirt/qemu/*.xml /etc/libvirt/lxc/*.xml; do
              test -f "$file" || continue
              # get (old) emulator path from config file
              emulator=$(grep "^[[:space:]]*<emulator>" "$file" | sed 's,^[[:space:]]*<emulator>\(.*\)</emulator>.*,\1,')
              # get a (definitely) working emulator path by re-scanning $PATH
              new_emulator=$(PATH=${pkgs.libvirt}/libexec:$PATH command -v $(basename "$emulator"))
              # write back
              sed -i "s,^[[:space:]]*<emulator>.*,    <emulator>$new_emulator</emulator> <!-- WARNING: emulator dirname is auto-updated by the nixos libvirtd module -->," "$file"
          done
        ''; # */
  
        serviceConfig = {
          ExecStart = ''@${pkgs.libvirt}/sbin/libvirtd libvirtd --config "${configFile}" --daemon ${concatStringsSep " " cfg.extraOptions}'';
          Type = "notify";
          KillMode = "process"; # when stopping, leave the VMs alone
          Restart = "on-failure";
        };
      };
  
      systemd.sockets.virtlogd = {
        description = "Virtual machine log manager socket";
  