anchor.diff:        buildInputs = with pkgs; [
           cfg.package
         ];
  -      installPhase = 
  -        ''
  -        ensureDir $out/
  -        '';
  +      installPhase = "mkdir -p $out";
       };
   
  -  in {
  +  in (mkMerge [{
   
  -    environment.systemPackages = [ cfg.package ]; 
  +    environment.systemPackages = [ cfg.package pkgs.ipsecTools ];
   
       boot.kernelModules = [ "tun" "openvswitch" ];
   
  
positive.code:       path = [ cfg.package ];
        restartTriggers = [ db cfg.package ];
        # Create the config database
        preStart = 
          ''
          mkdir -p ${runDir}
          mkdir -p /var/db/openvswitch
  
negative.code:       bindsTo = [ "ovsdb.service" ];
        after = [ "ovsdb.service" ];
        path = [ cfg.package ];
        serviceConfig = {
          ExecStart = ''
            ${cfg.package}/bin/ovs-vswitchd \
            --pidfile=/var/run/openvswitch/ovs-vswitchd.pid \
            --detach
          '';
          PIDFile = "/var/run/openvswitch/ovs-vswitchd.pid";
          Type = "forking";
        };
      };
  
    }
    (mkIf cfg.ipsec {
      services.racoon.enable = true;
      services.racoon.configPath = "${runDir}/ipsec/etc/racoon/racoon.conf";
  
      networking.firewall.extraCommands = ''
        iptables -I INPUT -t mangle -p esp -j MARK --set-mark 1/1
        iptables -I INPUT -t mangle -p udp --dport 4500 -j MARK --set-mark 1/1
      '';
  
      systemd.services.ovs-monitor-ipsec = {
        description = "Open_vSwitch Ipsec Daemon";
        wantedBy = [ "multi-user.target" ];
        requires = [ "racoon.service" ];
        after = [ "vswitchd.service" ];
        environment.UNIXCTLPATH = "/tmp/ovsdb.ctl.sock";
        serviceConfig = {
          ExecStart = ''
            ${cfg.package}/bin/ovs-monitor-ipsec \
              --root-prefix ${runDir}/ipsec \
              --pidfile /var/run/openvswitch/ovs-monitor-ipsec.pid \
              --monitor --detach \
              unix:/var/run/openvswitch/db.sock
          '';
          PIDFile = "/var/run/openvswitch/ovs-monitor-ipsec.pid";
          Type = "forking";
        };
  
        preStart = ''
          rm -r ${runDir}/ipsec/etc/racoon/certs || true
          mkdir -p ${runDir}/ipsec/{etc/racoon,etc/init.d/,usr/sbin/}
          ln -fs ${pkgs.ipsecTools}/bin/setkey ${runDir}/ipsec/usr/sbin/setkey
          ln -fs ${pkgs.writeScript "racoon-restart" ''
          #!${pkgs.stdenv.shell}
          /var/run/current-system/sw/bin/systemctl $1 racoon
          ''} ${runDir}/ipsec/etc/init.d/racoon
        '';
      };
    })]));
  
  }
  