anchor.diff:            A file which contains JSON configuration for yggdrasil.
             See the <option>config</option> option for more information.
           '';
  +      };
  +
  +      group = mkOption {
  +        type = types.nullOr types.str;
  +        default = null;
  +        example = "wheel";
  +        description = "Group to grant access to the Yggdrasil control socket. If <code>null</code>, only root can access the socket.";
         };
   
         openMulticastPort = mkOption {
  
positive.code:         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
          Restart = "always";
  
          User = "yggdrasil";
          DynamicUser = true;
          StateDirectory = "yggdrasil";
          RuntimeDirectory = "yggdrasil";
  
negative.code:         RestrictRealtime = true;
          SystemCallArchitectures = "native";
          SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
        } // (if (cfg.group != null) then {
          Group = cfg.group;
        } else {});
      };
  
      networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;
  