anchor.diff:              --certificate=db:Open_vSwitch,SSL,certificate \
               --bootstrap-ca-cert=db:Open_vSwitch,SSL,ca_cert \
               --unixctl=ovsdb.ctl.sock \
  -            --pidfile=/var/run/openvswitch/ovsdb.pid \
  +            --pidfile=/run/openvswitch/ovsdb.pid \
               --detach \
               /var/db/openvswitch/conf.db
             '';
           Restart = "always";
           RestartSec = 3;
  -        PIDFile = "/var/run/openvswitch/ovsdb.pid";
  +        PIDFile = "/run/openvswitch/ovsdb.pid";
           # Use service type 'forking' to correctly determine when ovsdb-server is ready.
           Type = "forking";
         };
  
positive.code:         ExecStart = ''
            ${cfg.package}/bin/ovs-monitor-ipsec \
              --root-prefix ${runDir}/ipsec \
              --pidfile /var/run/openvswitch/ovs-monitor-ipsec.pid \
              --monitor --detach \
              unix:/var/run/openvswitch/db.sock
          '';
          PIDFile = "/var/run/openvswitch/ovs-monitor-ipsec.pid";
          # Use service type 'forking' to correctly determine when ovs-monitor-ipsec is ready.
          Type = "forking";
        };
  
negative.code:   config = mkIf cfg.enable (let
  
      # Where the communication sockets live
      runDir = "/run/openvswitch";
  
      # The path to the an initialized version of the database
      db = pkgs.stdenv.mkDerivation {
  