anchor.diff:      } ''
         IKE preshared secret section for a specific secret. Each IKE PSK is
         defined in a unique section having the <literal>ike</literal> prefix.
  +    '';
  +
  +    ppk = mkPrefixedAttrsOfParams {
  +      secret = mkOptionalStrParam ''
  +	      Value of the PPK. It may either be an ASCII string, a hex encoded string
  +	      if it has a <literal>0x</literal> prefix or a Base64 encoded string if
  +	      it has a <literal>0s</literal> prefix in its value. Should have at least
  +	      256 bits of entropy for 128-bit security.
  +      '';
  +
  +      id = mkPrefixedAttrsOfParam (mkOptionalStrParam "") ''
  +	      PPK identity the PPK belongs to. Multiple unique identities may be
  +	      specified, each having an <literal>id</literal> prefix, if a secret is
  +	      shared between multiple peers.
  +      '';
  +    } ''
  +	    Postquantum Preshared Key (PPK) section for a specific secret. Each PPK is
  +	    defined in a unique section having the <literal>ppk</literal> prefix.
       '';
   
       private = mkPrefixedAttrsOfParams {
  
positive.code:         <literal>0xffffffff</literal>.
        '';
  
        tfc_padding = mkParamOfType (with lib.types; either int (enum ["mtu"])) 0 ''
          Pads ESP packets with additional data to have a consistent ESP packet
          size for improved Traffic Flow Confidentiality. The padding defines the
  
negative.code:         supported, but the installation does not fail otherwise.
        '';
  
        copy_df = mkYesNoParam yes ''
          Whether to copy the DF bit to the outer IPv4 header in tunnel mode. This
          effectively disables Path MTU discovery (PMTUD). Controlling this
          behavior is not supported by all kernel interfaces.
        '';
  
        copy_ecn = mkYesNoParam yes ''
          Whether to copy the ECN (Explicit Congestion Notification) header field
          to/from the outer IP header in tunnel mode. Controlling this behavior is
          not supported by all kernel interfaces.
        '';
  
        copy_dscp = mkEnumParam [ "out" "in" "yes" "no" ] "out" ''
          Whether to copy the DSCP (Differentiated Services Field Codepoint)
          header field to/from the outer IP header in tunnel mode. The value
          <literal>out</literal> only copies the field from the inner to the outer
          header, the value <literal>in</literal> does the opposite and only
          copies the field from the outer to the inner header when decapsulating,
          the value <literal>yes</literal> copies the field in both directions,
          and the value <literal>no</literal> disables copying the field
          altogether. Setting this to <literal>yes</literal> or
          <literal>in</literal> could allow an attacker to adversely affect other
          traffic at the receiver, which is why the default is
          <literal>out</literal>. Controlling this behavior is not supported by
          all kernel interfaces.
        '';
  
        start_action = mkEnumParam ["none" "trap" "start"] "none" ''
          Action to perform after loading the configuration.
          <itemizedlist>
  