anchor.diff:      networkConfig = mkOption {
         default = {};
         example = { Description = "My Network"; };
  -      type = types.attrsOf unitOption;
  +      type = types.addCheck (types.attrsOf unitOption) checkNetwork;
         description = ''
           Each attribute in this set specifies an option in the
           <literal>[Network]</literal> section of the unit.  See
  
positive.code:     addressConfig = mkOption {
        default = {};
        example = { Address = "192.168.0.100/24"; };
        type = types.attrsOf unitOption;
        description = ''
          Each attribute in this set specifies an option in the
          <literal>[Address]</literal> section of the unit.  See
  
negative.code: 
  let
  
    boolValues = [true false "yes" "no"];
  
    assertValueOneOf = name: values: group: attr:
      optional (attr ? ${name} && !elem attr.${name} values)
        "Systemd ${group} field `${name}' cannot have value `${attr.${name}}'.";
  
    assertHasField = name: group: attr:
      optional (!(attr ? ${name}))
        "Systemd ${group} field `${name}' must exist.";
  
    assertOnlyFields = fields: group: attr:
      let badFields = filter (name: ! elem name fields) (attrNames attr); in
      optional (badFields != [ ])
        "Systemd ${group} has extra fields [${concatStringsSep " " badFields}].";
  
    assertRange = name: min: max: group: attr:
      optional (attr ? ${name} && !(min <= attr.${name} && max >= attr.${name}))
        "Systemd ${group} field `${name}' is outside the range [${toString min},${toString max}]";
  
    digits = map toString (range 0 9);
  
    isByteFormat = s:
      let
        l = reverseList (stringToCharacters s);
        suffix = head l;
        nums = tail l;
      in elem suffix (["K" "M" "G" "T"] ++ digits)
        && all (num: elem num digits) nums;
  
    assertByteFormat = name: group: attr:
      optional (attr ? ${name} && ! isByteFormat attr.${name})
        "Systemd ${group} field `${name}' must be in byte format [0-9]+[KMGT].";
  
    hexChars = stringToCharacters "0123456789abcdefABCDEF";
  
    isMacAddress = s: stringLength s == 17
      && flip all (splitString ":" s) (bytes:
        all (byte: elem byte hexChars) (stringToCharacters bytes)
      );
  
    assertMacAddress = name: group: attr:
      optional (attr ? ${name} && ! isMacAddress attr.${name})
        "Systemd ${group} field `${name}' must be a valid mac address.";
  
    checkUnitConfig = group: checks: v:
      let errors = concatMap (c: c group v) checks; in
      if errors == [] then true
        else builtins.trace (concatStringsSep "\n" errors) false;
  
    checkService = checkUnitConfig "Service" [
      (assertValueOneOf "Type" [
        "simple" "forking" "oneshot" "dbus" "notify" "idle"
      ])
      (assertValueOneOf "Restart" [
        "no" "on-success" "on-failure" "on-abort" "always"
      ])
    ];
  
    checkLink = checkUnitConfig "Link" [
      (assertOnlyFields [
        "Description" "Alias" "MACAddressPolicy" "MACAddress" "NamePolicy" "Name"
        "MTUBytes" "BitsPerSecond" "Duplex" "WakeOnLan"
      ])
      (assertValueOneOf "MACAddressPolicy" ["persistent" "random"])
      (assertMacAddress "MACAddress")
      (assertValueOneOf "NamePolicy" [
        "kernel" "database" "onboard" "slot" "path" "mac"
      ])
      (assertByteFormat "MTUBytes")
      (assertByteFormat "BitsPerSecond")
      (assertValueOneOf "Duplex" ["half" "full"])
      (assertValueOneOf "WakeOnLan" ["phy" "magic" "off"])
    ];
  
    checkNetdev = checkUnitConfig "Netdev" [
      (assertOnlyFields [
        "Description" "Name" "Kind" "MTUBytes" "MACAddress"
      ])
      (assertHasField "Name")
      (assertHasField "Kind")
      (assertValueOneOf "Kind" [
        "bridge" "bond" "vlan" "macvlan" "vxlan" "ipip"
        "gre" "sit" "vti" "veth" "tun" "tap" "dummy"
      ])
      (assertByteFormat "MTUBytes")
      (assertMacAddress "MACAddress")
    ];
  
    checkVlan = checkUnitConfig "VLAN" [
      (assertOnlyFields ["Id"])
      (assertRange "Id" 0 4094)
    ];
  
    checkMacvlan = checkUnitConfig "MACVLAN" [
      (assertOnlyFields ["Mode"])
      (assertValueOneOf "Mode" ["private" "vepa" "bridge" "passthru"])
    ];
  
    checkVxlan = checkUnitConfig "VXLAN" [
      (assertOnlyFields ["Id" "Group" "TOS" "TTL" "MacLearning"])
      (assertRange "TTL" 0 255)
      (assertValueOneOf "MacLearning" boolValues)
    ];
  
    checkTunnel = checkUnitConfig "Tunnel" [
      (assertOnlyFields ["Local" "Remote" "TOS" "TTL" "DiscoverPathMTU"])
      (assertRange "TTL" 0 255)
      (assertValueOneOf "DiscoverPathMTU" boolValues)
    ];
  
    checkPeer = checkUnitConfig "Peer" [
      (assertOnlyFields ["Name" "MACAddress"])
      (assertMacAddress "MACAddress")
    ];
  
    tunTapChecks = [
      (assertOnlyFields ["OneQueue" "MultiQueue" "PacketInfo" "User" "Group"])
      (assertValueOneOf "OneQueue" boolValues)
      (assertValueOneOf "MultiQueue" boolValues)
      (assertValueOneOf "PacketInfo" boolValues)
    ];
  
    checkTun = checkUnitConfig "Tun" tunTapChecks;
  
    checkTap = checkUnitConfig "Tap" tunTapChecks;
  
    checkBond = checkUnitConfig "Bond" [
      (assertOnlyFields [
        "Mode" "TransmitHashPolicy" "LACPTransmitRate" "MIIMonitorSec"
        "UpDelaySec" "DownDelaySec"
      ])
      (assertValueOneOf "Mode" [
        "balance-rr" "active-backup" "balance-xor"
        "broadcast" "802.3ad" "balance-tlb" "balance-alb"
      ])
      (assertValueOneOf "TransmitHashPolicy" [
        "layer2" "layer3+4" "layer2+3" "encap2+3" "802.3ad" "encap3+4"
      ])
      (assertValueOneOf "LACPTransmitRate" ["slow" "fast"])
    ];
  
    checkNetwork = checkUnitConfig "Network" [
      (assertOnlyFields [
        "Description" "DHCP" "DHCPServer" "IPv4LL" "IPv4LLRoute"
        "LLMNR" "Domains" "Bridge" "Bond"
      ])
      (assertValueOneOf "DHCP" ["both" "none" "v4" "v6"])
      (assertValueOneOf "DHCPServer" boolValues)
      (assertValueOneOf "IPv4LL" boolValues)
      (assertValueOneOf "IPv4LLRoute" boolValues)
      (assertValueOneOf "LLMNR" boolValues)
    ];
  
    checkAddress = checkUnitConfig "Address" [
      (assertOnlyFields ["Address" "Peer" "Broadcast" "Label"])
      (assertHasField "Address")
    ];
  
    checkRoute = checkUnitConfig "Route" [
      (assertOnlyFields ["Gateway" "Destination" "Metric"])
      (assertHasField "Gateway")
    ];
  
    checkDhcp = checkUnitConfig "DHCP" [
      (assertOnlyFields [
        "UseDNS" "UseMTU" "SendHostname" "UseHostname" "UseDomains" "UseRoutes"
        "CriticalConnections" "VendorClassIdentifier" "RequestBroadcast"
        "RouteMetric"
      ])
      (assertValueOneOf "UseDNS" boolValues)
      (assertValueOneOf "UseMTU" boolValues)
      (assertValueOneOf "SendHostname" boolValues)
      (assertValueOneOf "UseHostname" boolValues)
      (assertValueOneOf "UseDomains" boolValues)
      (assertValueOneOf "UseRoutes" boolValues)
      (assertValueOneOf "CriticalConnections" boolValues)
      (assertValueOneOf "RequestBroadcast" boolValues)
    ];
  
    unitOption = mkOptionType {
      name = "systemd option";
  