anchor.diff:            Restart = "always";
             User = serviceUser;
             Group = serviceGroup;
  -          ExecStart = "${cfg.package}/bin/nebula -config ${nebulaConfig}";
  +          ExecStart = "${cfg.package}/bin/nebula -config ${configFile}";
           };
         };
   
  
positive.code: 
    cfg = config.services.nebula;
    nebulaDesc = "Nebula VPN service";
  
  in
  {
  
negative.code: 
    config =
      let
        # The service needs to launch as root to access the tun device, if it's enabled.
        serviceUser = if cfg.tun.disable then "nebula" else "root";
        serviceGroup = if cfg.tun.disable then "nebula" else "root";
      in mkIf cfg.enable {
        services.nebula.settings = {
          pki = {
            ca = cfg.ca;
            cert = cfg.cert;
            key = cfg.key;
          };
          static_host_map = cfg.staticHostMap;
          lighthouse = {
            am_lighthouse = cfg.isLighthouse;
            hosts = cfg.lighthouses;
          };
          listen = {
            host = cfg.listen.host;
            port = cfg.listen.port;
          };
          punchy = {
            punch = cfg.punch;
          };
          tun = {
            disabled = cfg.tun.disable;
            dev = cfg.tun.device;
          };
          firewall = {
            inbound = cfg.firewall.inbound;
            outbound = cfg.firewall.outbound;
          };
        };
  
        # Create systemd service for Nebula.
        systemd.services.nebula = {
          description = nebulaDesc;
  