anchor.diff: +# This module enables a simple firewall.
  +
   { config, pkgs, ... }:
   
   with pkgs.lib;
  
positive.code:       default = false;
        description =
          ''
            Whether to enable the firewall.
          '';
      };
    
  
negative.code:   # doesn't deal with such Upstart jobs properly (it starts them if
    # they are changed, regardless of whether the start condition
    # holds).
    config = mkIf cfg.enable {
  
      environment.systemPackages = [ pkgs.iptables ];
  
  