anchor.diff:  
         downScript = ''
           #! /bin/sh
  -        exec > /var/log/openvpn-${name}-down 2>&1
           export PATH=${path}
           ${cfg.down}
         '';
   
         configFile = pkgs.writeText "openvpn-config-${name}"
           ''
  +          errors-to-stderr
             ${optionalString (cfg.up != "" || cfg.down != "") "script-security 2"}
             ${cfg.config}
             ${optionalString (cfg.up != "") "up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
  
positive.code:     in {
        description = "OpenVPN instance ‘${name}’";
  
        startOn = mkDefault "started network-interfaces";
        stopOn = mkDefault "stopping network-interfaces";
  
        path = [ pkgs.iptables pkgs.iproute pkgs.nettools ];
  
        exec = "${openvpn}/sbin/openvpn --config ${configFile}";
      };
  
  in
  
negative.code: 
    config = mkIf (cfg.servers != {}) {
  
      systemd.services = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) cfg.servers);
  
      environment.systemPackages = [ openvpn ];
  
  