anchor.diff:          This is necessary to allow firmware upgrades and device discovery to
           work. For remote login, you should additionally open (or forward) port
           8443.
  +      '';
  +    };
  +
  +    services.unifi.initialJavaHeapSize = mkOption {
  +      type = types.nullOr types.int;
  +      default = null;
  +      example = 1024;
  +      description = ''
  +        Set the initial heap size for the JVM in MB. If this option isn't set, the
  +        JVM will decide this value at runtime.
  +      '';
  +    };
  +
  +    services.unifi.maximumJavaHeapSize = mkOption {
  +      type = types.nullOr types.int;
  +      default = null;
  +      example = 4096;
  +      description = ''
  +        Set the maximimum heap size for the JVM in MB. If this option isn't set, the
  +        JVM will decide this value at runtime.
         '';
       };
   
  
positive.code: 
        serviceConfig = {
          Type = "simple";
          ExecStart = "${cmd} start";
          ExecStop = "${cmd} stop";
          User = "unifi";
          PermissionsStartOnly = true;
          UMask = "0077";
  
negative.code: let
    cfg = config.services.unifi;
    stateDir = "/var/lib/unifi";
    cmd = ''
      @${pkgs.jre}/bin/java java \
          ${optionalString (cfg.initialJavaHeapSize != null) "-Xms${(toString cfg.initialJavaHeapSize)}m"} \
          ${optionalString (cfg.maximumJavaHeapSize != null) "-Xmx${(toString cfg.maximumJavaHeapSize)}m"} \
          -jar ${stateDir}/lib/ace.jar
    '';
    mountPoints = [
      {
        what = "${pkgs.unifi}/dl";
  