anchor.diff:  
       environment.systemPackages = [ pkgs.varnish ];
   
  +    # check .vcl syntax at compile time (e.g. before nixops deployment)
  +    system.extraDependencies = [
  +      (pkgs.stdenv.mkDerivation {
  +        name = "check-varnish-syntax";
  +        preferLocalBuild = true;
  +        buildCommand = "${pkgs.varnish}/sbin/varnishd -C ${commandLine} 2> $out";
  +      })
  +    ];
  +
       users.extraUsers.varnish = {
         group = "varnish";
         uid = config.ids.uids.varnish;
  
positive.code: { config, lib, pkgs, ...}:
  let
    cfg = config.services.varnish;
  
  in
  with lib;
  {
    options = {
      services.varnish = {
  
negative.code:       serviceConfig = {
          Type = "simple";
          PermissionsStartOnly = true;
          ExecStart = "${pkgs.varnish}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
          Restart = "always";
          RestartSec = "5s";
          User = "varnish";
  