anchor.diff:    # doesn't deal with such Upstart jobs properly (it starts them if
     # they are changed, regardless of whether the start condition
     # holds).
  -  config = pkgs.lib.mkIf config.networking.firewall.enable {
  +  config = mkIf config.networking.firewall.enable {
   
       environment.systemPackages = [pkgs.iptables];
   
  -    jobs = pkgs.lib.singleton
  +    jobs = singleton
         { name = "firewall";
   
           startOn = "network-interfaces/started";
  
positive.code: 
    options = {
    
      networking.firewall.enable = pkgs.lib.mkOption {
        default = false;
        description =
          ''
  
negative.code: { config, pkgs, ... }:
  
  with pkgs.lib;
  
  let
  
    iptables = "${pkgs.iptables}/sbin/iptables";
  
    cfg = config.networking.firewall;
  
  in
  
  