anchor.diff:  
         script =
           ''
  -          exec &> /var/log/openvpn-${cfg.id}
  +          exec &> /var/log/openvpn-${name}
             ${config.system.sbin.modprobe} tun || true
             ${openvpn}/sbin/openvpn --config ${configFile}
           '';
       };
  +
  +  openvpnInstanceOptions = {
  +
  +    config = mkOption {
  +      type = types.string;
  +      description = ''
  +        config of this openvpn instance
  +      '';
  +    };
  +    up = mkOption {
  +      default = "";
  +      type = types.string;
  +      description = ''
  +        script which is run when server instance starts up succesfully.
  +        Use it to setup firewall and routing
  +      '';
  +    };
  +    down = mkOption {
  +      default = "";
  +      type = types.string;
  +      description = ''
  +        script which is run when server instance shuts down
  +        Usually this reverts what up has done
  +      '';
  +    };
  +
  +  };
   
   in
     
  
positive.code:         description = "Whether to enable OpenVPN.";
        };
  
        servers = mkOption {
          example = [
            {
              id = "server-simplest";
              config = ''
                # Most simple configuration: http://openvpn.net/index.php/documentation/miscellaneous/static-key-mini-howto.html.
                # server : 
                dev tun
                ifconfig 10.8.0.1 10.8.0.2
                secret static.key
              '';
              up = "ip route add ..!";
              down = "ip route add ..!";
            }
            {
              id = "client-simplest";
              config = ''
                #client:
                #remote myremote.mydomain
                #dev tun
                #ifconfig 10.8.0.2 10.8.0.1
                #secret static.key
              '';
            }
            {
              id = "server-scalable";
              config = ''
                multiple clienst
                see example file found in http://openvpn.net/index.php/documentation/howto.html
              '';
            }
            {
              id = "client-scalabe";
              config = '' dito '';
            }
          ];
          default = [];
          # !!! clean up this description please
          description = ''
            openvpn instances to be run. Each will be put into an extra job named openvpn-{id}
  
            The up and down properties will be added config line up=/nix/store/xxx-up-script
            automatically for you. If you define at least one of up/down
            "script-security 2" will be prepended to your config.
  
            Don't forget to check that the all package sizes can be sent. if scp hangs or such you should set
            --fragment XXX --mssfix YYY.
          '';
        };
        
      };
  
    };
  
negative.code:   ###### implementation
  
    config = mkIf cfg.enable {
      jobs = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) cfg.servers);
    };
    
  }
  