anchor.diff:          '';
         };
   
  +  # the target is required to start new peer units when they are added
  +  generateInterfaceTarget = name: values:
  +    let
  +      mkPeerUnit = peer: (peerUnitServiceName name peer.publicKey (peer.dynamicEndpointRefreshSeconds != 0)) + ".service";
  +    in
  +    nameValuePair "wireguard-${name}"
  +      rec {
  +        description = "WireGuard Tunnel - ${name}";
  +        wantedBy = [ "multi-user.target" ];
  +        wants = [ "wireguard-${name}.service" ] ++ map mkPeerUnit values.peers;
  +        after = wants;
  +      };
  +
     generateInterfaceUnit = name: values:
       # exactly one way to specify the private key must be set
       #assert (values.privateKey != null) != (values.privateKeyFile != null);
  
positive.code:       // (mapAttrs' generateKeyServiceUnit
        (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
  
    });
  
  }
  
negative.code:         after = [ "network-pre.target" ];
          wants = [ "network.target" ];
          before = [ "network.target" ];
          environment.DEVICE = name;
          path = with pkgs; [ kmod iproute2 wireguard-tools ];
  
  