anchor.diff:    cfg = config.services.stunnel;
     yesNo = val: if val then "yes" else "no";
   
  +  verifyRequiredField = type: field: n: c: {
  +    assertion = hasAttr field c;
  +    message =  "stunnel: \"${n}\" ${type} configuration - Field ${field} is required.";
  +  };
  +
     verifyChainPathAssert = n: c: {
  -    assertion = c.verifyHostname == null || (c.verifyChain || c.verifyPeer);
  +    assertion = (c.verifyHostname or null) == null || (c.verifyChain || c.verifyPeer);
       message =  "stunnel: \"${n}\" client configuration - hostname verification " +
         "is not possible without either verifyChain or verifyPeer enabled";
     };
   
  -  serverConfig = {
  -    options = {
  -      accept = mkOption {
  -        type = types.either types.str types.int;
  -        description = ''
  -          On which [host:]port stunnel should listen for incoming TLS connections.
  -          Note that unlike other softwares stunnel ipv6 address need no brackets,
  -          so to listen on all IPv6 addresses on port 1234 one would use ':::1234'.
  -        '';
  -      };
  -
  -      connect = mkOption {
  -        type = types.either types.str types.int;
  -        description = "Port or IP:Port to which the decrypted connection should be forwarded.";
  -      };
  -
  -      cert = mkOption {
  -        type = types.path;
  -        description = "File containing both the private and public keys.";
  -      };
  -    };
  -  };
  -
  -  clientConfig = {
  -    options = {
  -      accept = mkOption {
  -        type = types.str;
  -        description = "IP:Port on which connections should be accepted.";
  -      };
  -
  -      connect = mkOption {
  -        type = types.str;
  -        description = "IP:Port destination to connect to.";
  -      };
  -
  -      verifyChain = mkOption {
  -        type = types.bool;
  -        default = true;
  -        description = "Check if the provided certificate has a valid certificate chain (against CAPath).";
  -      };
  -
  -      verifyPeer = mkOption {
  -        type = types.bool;
  -        default = false;
  -        description = "Check if the provided certificate is contained in CAPath.";
  -      };
  -
  -      CAPath = mkOption {
  -        type = types.nullOr types.path;
  -        default = null;
  -        description = "Path to a directory containing certificates to validate against.";
  -      };
  -
  -      CAFile = mkOption {
  -        type = types.nullOr types.path;
  -        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
  -        defaultText = literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
  -        description = "Path to a file containing certificates to validate against.";
  -      };
  -
  -      verifyHostname = mkOption {
  -        type = with types; nullOr str;
  -        default = null;
  -        description = "If set, stunnel checks if the provided certificate is valid for the given hostname.";
  -      };
  -    };
  -  };
  -
  +  removeNulls = mapAttrs (_: filterAttrs (_: v: v != null));
  +  mkValueString = v:
  +    if v == true then "yes"
  +    else if v == false then "no"
  +    else generators.mkValueStringDefault {} v;
  +  generateConfig = c:
  +    generators.toINI {
  +      mkSectionName = id;
  +      mkKeyValue = k: v: "${k} = ${mkValueString v}";
  +    } (removeNulls c);
   
   in
   
  
positive.code: 
  
        servers = mkOption {
          description = "Define the server configuations.";
          type = with types; attrsOf (submodule serverConfig);
          example = {
            fancyWebserver = {
              accept = 443;
  
negative.code:       ${ optionalString cfg.enableInsecureSSLv3 "options = -NO_SSLv3" }
  
        ; ----- SERVER CONFIGURATIONS -----
        ${ generateConfig cfg.servers }
  
        ; ----- CLIENT CONFIGURATIONS -----
        ${ generateConfig cfg.clients }
      '';
  
      systemd.services.stunnel = {
  