anchor.diff:        };
   
         preSetup = mkOption {
  -        example = literalExample [''
  +        example = literalExample ''
             ${pkgs.iproute}/bin/ip netns add foo
  -        ''];
  -        default = [];
  -        type = with types; listOf str;
  -        description = ''
  -          A list of commands called at the start of the interface setup.
  +        '';
  +        default = "";
  +        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
  +        description = ''
  +          Commands called at the start of the interface setup.
           '';
         };
   
         postSetup = mkOption {
  -        example = literalExample [''
  -          ${pkgs.bash} -c 'printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0'
  -        ''];
  -        default = [];
  -        type = with types; listOf str;
  -        description = "A list of commands called at the end of the interface setup.";
  +        example = literalExample ''
  +          printf "nameserver 10.200.100.1" | ${pkgs.openresolv}/bin/resolvconf -a wg0 -m 0
  +        '';
  +        default = "";
  +        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
  +        description = "Commands called at the end of the interface setup.";
         };
   
         postShutdown = mkOption {
  -        example = literalExample ["${pkgs.openresolv}/bin/resolvconf -d wg0"];
  -        default = [];
  -        type = with types; listOf str;
  -        description = "A list of commands called after shutting down the interface.";
  +        example = literalExample "${pkgs.openresolv}/bin/resolvconf -d wg0";
  +        default = "";
  +        type = with types; coercedTo (listOf str) (concatStringsSep "\n") lines;
  +        description = "Commands called after shutting down the interface.";
         };
   
         table = mkOption {
  
positive.code:         after = [ "network.target" ];
          wantedBy = [ "multi-user.target" ];
          environment.DEVICE = name;
  
          serviceConfig = {
            Type = "oneshot";
            RemainAfterExit = true;
            ExecStart = flatten([
              values.preSetup
  
              "-${ipCommand} link del dev ${name}"
              "${ipCommand} link add dev ${name} type wireguard"
  
              (map (ip:
              "${ipCommand} address add ${ip} dev ${name}"
              ) values.ips)
  
              ("${wgCommand} set ${name} private-key ${privKey}" +
              optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}")
  
              (map (peer:
              assert (peer.presharedKeyFile == null) || (peer.presharedKey == null); # at most one of the two must be set
              let psk = if peer.presharedKey != null then pkgs.writeText "wg-psk" peer.presharedKey else peer.presharedKeyFile;
              in
              "${wgCommand} set ${name} peer ${peer.publicKey}" +
              optionalString (psk != null) " preshared-key ${psk}" +
              optionalString (peer.endpoint != null) " endpoint ${peer.endpoint}" +
              optionalString (peer.persistentKeepalive != null) " persistent-keepalive ${toString peer.persistentKeepalive}" +
              optionalString (peer.allowedIPs != []) " allowed-ips ${concatStringsSep "," peer.allowedIPs}"
              ) values.peers)
  
              "${ipCommand} link set up dev ${name}"
  
              (optionals (values.allowedIPsAsRoutes != false) (map (peer:
              (map (allowedIP:
              "${ipCommand} route replace ${allowedIP} dev ${name} table ${values.table}"
              ) peer.allowedIPs)
              ) values.peers))
  
              values.postSetup
            ]);
            ExecStop = flatten([
              "${ipCommand} link del dev ${name}"
              values.postShutdown
            ]);
          };
        };
  
  in
  
negative.code:     };
  
    };
  
    generateUnit = name: values:
      # exactly one way to specify the private key must be set
  