anchor.diff:          '';
         };
       };
  +    config = { name = mkDefault name; };
  +  };
  +
  +  mkNamedNylon = cfg: {
  +    "nylon-${cfg.name}" = {
  +      description = "Nylon, a lightweight SOCKS proxy server";
  +      after = [ "network.target" ];
  +      wantedBy = [ "multi-user.target" ];
  +      serviceConfig =
  +      {
  +        User = "nylon";
  +        Group = "nylon";
  +        WorkingDirectory = homeDir;
  +        ExecStart = "${pkgs.nylon}/bin/nylon -f -c ${configFile cfg}";
  +      };
  +    };
  +  };
  +
  +  anyNylons = collect (p: p ? enable) cfg;
  +  enabledNylons = filter (p: p.enable == true) anyNylons;
  +  nylonUnits = map (nylon: mkNamedNylon nylon) enabledNylons;
  +
  +in
  +
  +{
  +
  +  ###### interface
  +
  +  options = {
  +
  +    services.nylon = mkOption {
  +      default = {};
  +      description = "Collection of named nylon instances";
  +      type = with types; loaOf (submodule nylonOpts);
  +      internal = true;
  +      options = [ nylonOpts ];
  +    };
  +
     };
   
     ###### implementation
   
  -  config = mkIf cfg.enable {
  +  config = mkIf (length(enabledNylons) > 0) {
   
  -    users.extraUsers.nylon= {
  +    users.extraUsers.nylon = {
         group = "nylon";
         description = "Nylon SOCKS Proxy";
         home = homeDir;
  
positive.code:     Deny-IP=${concatStringsSep " " cfg.deniedIPRanges}
    '';
  
  in
  
  {
  
    ###### interface
  
    options = {
  
      services.nylon = {
  
        enable = mkOption {
          type = types.bool;
  
negative.code:         description = ''
            Enables nylon as a running service upon activation.
          '';
        };
  
        name = mkOption {
          type = types.str;
          default = "";
          description = "The name of this nylon instance.";
        };
  
        nrConnections = mkOption {
  