anchor.diff:              cryptsetup    # luks
               mtools        # disk labelling
               smartmontools # disk monitoring
  +            lm_sensors    # fan monitoring
               procps        # ps, top, pidof, vmstat, slabtop, skill, w
               psmisc        # fuser, killall, pstree, peekfd
               shadow        # passwd, su
  
positive.code: 
          # Encrypted LUKS key will be stored as a gzipped cpio archive image
          # This allows us to use single password unlock
          boot.initrd.prepend = [ "${./secrets/luks-key.img.cpio.gz}" ];
  
          # make sure to decrypt our luks-key.img virtual block device first
          boot.initrd.luks.devices = 
  
negative.code:                 logRefusedPackets = true;
                  logRefusedUnicastsOnly = true;
              };
              interfaces = {
                  wlp6s0 = {
                      ipAddress = "10.0.0.1";
                      prefixLength = 24;
                      ipv6Address = "fd99:cbc4:692::1";
                      ipv6PrefixLength = 64;
                  };
              };
              nat = {
                  enable = true;
                  externalInterface = "enp7s0";
                  internalInterfaces = [ "wlp6s0" ];
                  forwardPorts = [];
              };
          };
  
          i18n = {
  