anchor.diff:  
         upScript = ''
           #! /bin/sh
  -        exec > /var/log/openvpn-${name}-up 2>&1
           export PATH=${path}
   
           # For convenience in client scripts, extract the remote domain
  
positive.code:     in {
        description = "OpenVPN instance ‘${name}’";
  
        startOn = mkDefault "started network-interfaces";
        stopOn = mkDefault "stopping network-interfaces";
  
        path = [ pkgs.iptables pkgs.iproute pkgs.nettools ];
  
        exec = "${openvpn}/sbin/openvpn --config ${configFile}";
      };
  
  in
  
negative.code: 
        downScript = ''
          #! /bin/sh
          export PATH=${path}
          ${cfg.down}
        '';
  
        configFile = pkgs.writeText "openvpn-config-${name}"
          ''
            errors-to-stderr
            ${optionalString (cfg.up != "" || cfg.down != "") "script-security 2"}
            ${cfg.config}
            ${optionalString (cfg.up != "") "up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
  