anchor.diff:      ResultActive=yes
     */
     polkitConf = ''
  -    polkit.addRule(function(action, subject) {
  -      if (
  -        subject.isInGroup("networkmanager")
  -        && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
  +    polkit.addRule(
  +      function(action, subject) {
  +        if (
  +          subject.isInGroup("networkmanager")
  +          && (
  +            action.id.indexOf("org.freedesktop.NetworkManager.") == 0
               || action.id.indexOf("org.freedesktop.ModemManager")  == 0
  -        ))
  -          { return polkit.Result.YES; }
  -    });
  +          )
  +        ) {
  +          return polkit.Result.YES;
  +        }
  +      }
  +    );
     '';
   
     ipUpScript = pkgs.writeScript "01-nixos-network-online" ''
  
positive.code:         source = overrideNameserversScript;
          target = "NetworkManager/dispatcher.d/02-override-dns";
        }
      ] ++ lib.imap (i: s: {
          text = s.source;
          target = "NetworkManager/dispatcher.d/"
            + "${dispatcherTypesSubdirMap.${s.type}}03-userscript${lib.fixedWidthNumber 4 i}";
        }) cfg.dispatcherScripts;
  
      environment.systemPackages = cfg.packages;
  
      users.extraGroups = [{
        name = "networkmanager";
        gid = config.ids.gids.networkmanager;
      }
      {
        name = "nm-openvpn";
        gid = config.ids.gids.nm-openvpn;
      }];
      users.extraUsers = [{
        name = "nm-openvpn";
        uid = config.ids.uids.nm-openvpn;
      }];
  
      systemd.packages = cfg.packages;
  
  
negative.code:   inherit (lib)
      concatStrings
      concatStringsSep
      fixedWidthNumber
      imap
      mkIf
      mkOption
      optionals
  