anchor.diff:            wg set ${name} private-key ${privKey} ${
               optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}"}
   
  -          ${concatMapStringsSep "\n" (peer:
  -            assert (peer.presharedKeyFile == null) || (peer.presharedKey == null); # at most one of the two must be set
  -            let psk = if peer.presharedKey != null then pkgs.writeText "wg-psk" peer.presharedKey else peer.presharedKeyFile;
  -            in
  -              "wg set ${name} peer ${peer.publicKey}" +
  -              optionalString (psk != null) " preshared-key ${psk}" +
  -              optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
  -              optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
  -              optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}"
  -            ) values.peers}
  -
             ip link set up dev ${name}
  -
  -          ${optionalString (values.allowedIPsAsRoutes != false) (concatStringsSep "\n" (concatMap (peer:
  -              (map (allowedIP:
  -                "ip route replace ${allowedIP} dev ${name} table ${values.table}"
  -              ) peer.allowedIPs)
  -            ) values.peers))}
   
             ${values.postSetup}
           '';
  
positive.code:         '';
        };
  
  
    generateSetupServiceUnit = name: values:
      # exactly one way to specify the private key must be set
      #assert (values.privateKey != null) != (values.privateKeyFile != null);
      let privKey = if values.privateKeyFile != null then values.privateKeyFile else pkgs.writeText "wg-key" values.privateKey;
  
negative.code:         path = with pkgs; [ kmod iproute wireguard-tools ];
  
          serviceConfig = {
            Type = "oneshot";
            RemainAfterExit = true;
          };
  
  