anchor.diff:        xchg      = { source = ''"$TMPDIR"/xchg''; target = "/tmp/xchg"; };
         shared    = { source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"''; target = "/tmp/shared"; };
       };
  +
  +    virtualisation.qemu.networkingOptions =
  +      let
  +        forwardingOptions = flip concatMapStrings cfg.forwardPorts
  +          ({ proto, from, host, guest }:
  +            if from == "host"
  +              then "hostfwd=${proto}:${host.address}:${toString host.port}-" +
  +                   "${guest.address}:${toString guest.port},"
  +              else "'guestfwd=${proto}:${guest.address}:${toString guest.port}-" +
  +                   "cmd:${pkgs.netcat}/bin/nc ${host.address} ${toString host.port}',"
  +          );
  +      in
  +      [
  +        "-net nic,netdev=user.0,model=virtio"
  +        "-netdev user,id=user.0,${forwardingOptions}\${QEMU_NET_OPTS:+,$QEMU_NET_OPTS}"
  +      ];
   
       # FIXME: Consolidate this one day.
       virtualisation.qemu.options = mkMerge [
  
positive.code: 
        networkingOptions =
          mkOption {
            default = [
              "-net nic,netdev=user.0,model=virtio"
              "-netdev user,id=user.0\${QEMU_NET_OPTS:+,$QEMU_NET_OPTS}"
            ];
            type = types.listOf types.str;
            description = ''
              Networking-related command-line options that should be passed to qemu.
              The default is to use userspace networking (SLiRP).
  
              If you override this option, be advised to keep
              ''${QEMU_NET_OPTS:+,$QEMU_NET_OPTS} (as seen in the default)
              to keep the default runtime behaviour.
            '';
          };
  
negative.code:   };
  
    config = {
  
      assertions =
        lib.concatLists (lib.flip lib.imap cfg.forwardPorts (i: rule:
          [
            { assertion = rule.from == "guest" -> rule.proto == "tcp";
              message =
                ''
                  Invalid virtualisation.forwardPorts.<entry ${toString i}>.proto:
                    Guest forwarding supports only TCP connections.
                '';
            }
            { assertion = rule.from == "guest" -> lib.hasPrefix "10.0.2." rule.guest.address;
              message =
                ''
                  Invalid virtualisation.forwardPorts.<entry ${toString i}>.guest.address:
                    The address must be in the default VLAN (10.0.2.0/24).
                '';
            }
          ]));
  
      # Note [Disk layout with `useBootLoader`]
      #
  