anchor.diff:    config = mkIf cfg.enable {
   
       assertions = [
  -      { assertion = config.networking.wireless.enable == false;
  -        message = "You can not use networking.networkmanager with networking.wireless";
  +      { assertion = config.networking.wireless.enable == true -> cfg.unmanaged != [];
  +        message = ''
  +          You can not use networking.networkmanager with networking.wireless.
  +          Except if you mark some interfaces as <literal>unmanaged</literal> by NetworkManager.
  +        '';
         }
         { assertion = !dynamicHostsEnabled || (dynamicHostsEnabled && cfg.dns == "dnsmasq");
           message = ''
  
positive.code:       path = [ pkgs.iproute pkgs.utillinux pkgs.coreutils ];
      };
  
      # Turn off NixOS' network management
      networking = {
        useDHCP = false;
        # use mkDefault to trigger the assertion about the conflict above
        wireless.enable = mkDefault false;
      };
  
      security.polkit.extraConfig = polkitConf;
  
      networking.networkmanager.packages =
        mkIf cfg.enableStrongSwan [ pkgs.networkmanager_strongswan ];
  
      services.dbus.packages =
        optional cfg.enableStrongSwan pkgs.strongswanNM ++ cfg.packages;
  
negative.code:       basePackages = mkOption {
          type = types.attrsOf types.package;
          default = { inherit (pkgs)
                              networkmanager modemmanager crda
                              networkmanager-openvpn networkmanager-vpnc
                              networkmanager-openconnect networkmanager-fortisslvpn
                              networkmanager-l2tp networkmanager-iodine; }
                    // optionalAttrs (!delegateWireless) { inherit (pkgs) wpa_supplicant; };
          internal = true;
        };
  
  