anchor.diff:        '';
       };
   
  +    services.unifi.openPorts = mkOption {
  +      type = types.bool;
  +      default = true;
  +      description = ''
  +        Whether or not to open the minimum required ports on the firewall.
  +
  +        This is necessary to allow firmware upgrades and device discovery to
  +        work. For remote login, you should additionally open (or forward) port
  +        8443.
  +      '';
  +    };
  +
     };
   
     config = mkIf cfg.enable {
  
positive.code:       uid = config.ids.uids.unifi;
        description = "UniFi controller daemon user";
        home = "${stateDir}";
      };
  
      # We must create the binary directories as bind mounts instead of symlinks
  
negative.code: 
        preStart = ''
          # Ensure privacy of state and data.
          chown unifi "${stateDir}" "${stateDir}/data"
          chmod 0700 "${stateDir}" "${stateDir}/data"
  
          # Create the volatile webapps
          rm -rf "${stateDir}/webapps"
  