anchor.diff:                  ''
                     ip46tables -A INPUT -p udp --dport ${toString port} -j ACCEPT
                   ''
  -              ) config.networking.firewall.allowedUDPPorts
  +              ) cfg.allowedUDPPorts
               }
   
               # Accept IPv4 multicast.  Not a big security risk since
  
positive.code: { config, pkgs, ... }:
  
  with pkgs.lib;
  
negative.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf cfg.enable {
  
      environment.systemPackages = [ pkgs.iptables ];
  
  