anchor.diff:                  Note that tinc can't run scripts anymore (such as tinc-down or host-up), unless it is setup to be runnable inside chroot environment.
                 '';
               };
  +
  +            settings = mkOption {
  +              default = { };
  +              type = types.submodule { freeformType = tincConfType; };
  +              example = literalExample ''
  +                {
  +                  Interface = "custom.interface";
  +                  DirectOnly = true;
  +                  Mode = "switch";
  +                }
  +              '';
  +              description = ''
  +                Configuration of the Tinc daemon for this network.
  +
  +                See <link xlink:href="https://tinc-vpn.org/documentation-1.1/Main-configuration-variables.html"/>
  +                for supported values.
  +              '';
  +            };
             };
  -        });
  +
  +          config = {
  +            hosts = mapAttrs
  +              (hostname: host: ''
  +                ${toTincConf host.settings}
  +                ${host.rsaPublicKey}
  +              '')
  +              config.hostSettings;
  +
  +            settings = {
  +              DeviceType = mkDefault config.interfaceType;
  +              Name = mkDefault (if config.name == null then "$HOST" else config.name);
  +              Ed25519PrivateKeyFile = mkIf (config.ed25519PrivateKeyFile != null) (mkDefault config.ed25519PrivateKeyFile);
  +              PrivateKeyFile = mkIf (config.rsaPrivateKeyFile != null) (mkDefault config.rsaPrivateKeyFile);
  +              ListenAddress = mkIf (config.listenAddress != null) (mkDefault config.listenAddress);
  +              BindToAddress = mkIf (config.bindToAddress != null) (mkDefault config.bindToAddress);
  +            };
  +          };
  +        }));
   
           description = ''
             Defines the tinc networks which will be started.
  
positive.code:           "tinc/${network}/tinc.conf" = {
              mode = "0444";
              text = ''
                Name = ${if data.name == null then "$HOST" else data.name}
                DeviceType = ${data.interfaceType}
                ${optionalString (data.ed25519PrivateKeyFile != null) "Ed25519PrivateKeyFile = ${data.ed25519PrivateKeyFile}"}
                ${optionalString (data.rsaPrivateKeyFile != null) "PrivateKeyFile = ${data.rsaPrivateKeyFile}"}
                ${optionalString (data.listenAddress != null) "ListenAddress = ${data.listenAddress}"}
                ${optionalString (data.bindToAddress != null) "BindToAddress = ${data.bindToAddress}"}
                Interface = tinc.${network}
                ${data.extraConfig}
              '';
            };
  
negative.code:               description = ''
                  The name of the host in the network as well as the configuration for that host.
                  This name should only contain alphanumerics and underscores.
  
                  Note that using the declarative <option>service.tinc.networks.&lt;name&gt;.hostSettings</option>
                  option is preferred.
                '';
              };
  
              hostSettings = mkOption {
                default = { };
                example = literalExample ''
                  {
                    host1 = {
                      addresses = [
                        { address = "192.168.1.42"; }
                        { address = "192.168.1.42"; port = 1655; }
                      ];
                      subnets = [ { address = "10.0.0.42"; } ];
                      rsaPublicKey = "...";
                      settings = {
                        Ed25519PublicKey = "...";
                      };
                    };
                    host2 = {
                      subnets = [ { address = "10.0.1.0"; prefixLength = 24; weight = 2; } ];
                      rsaPublicKey = "...";
                      settings = {
                        Compression = 10;
                      };
                    };
                  }
                '';
                type = types.attrsOf (types.submodule hostSubmodule);
                description = ''
                  The name of the host in the network as well as the configuration for that host.
                  This name should only contain alphanumerics and underscores.
                '';
              };
  
  