anchor.diff:          mapAttrs (name: value: {
             assertion = value.generatePrivateKeyFile -> (value.privateKey == null);
             message = "networking.wireguard.interfaces.${name}.generatePrivateKey must not be set if networking.wireguard.interfaces.${name}.privateKey is set.";
  -        }) cfg.interfaces));
  -
  +        }) cfg.interfaces))
  +        ++ map ({ interfaceName, peer, ... }: {
  +          assertion = (peer.presharedKey == null) || (peer.presharedKeyFile == null);
  +          message = "networking.wireguard.interfaces.${interfaceName} peer «${peer.publicKey}» has both presharedKey and presharedKeyFile set, but only one can be used.";
  +        }) all_peers;
   
       boot.extraModulePackages = [ kernel.wireguard ];
       environment.systemPackages = [ pkgs.wireguard-tools ];
   
  -    systemd.services = (mapAttrs' generateSetupServiceUnit cfg.interfaces)
  +    systemd.services =
  +      (mapAttrs' generateInterfaceUnit cfg.interfaces)
  +      // (listToAttrs (map generatePeerUnit all_peers))
         // (mapAttrs' generateKeyServiceUnit
         (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
   
       systemd.paths = mapAttrs' generatePathUnit
         (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
   
  -  };
  +  });
   
   }
  
positive.code: 
    ###### implementation
  
    config = mkIf cfg.enable {
  
      assertions = (attrValues (
          mapAttrs (name: value: {
  
negative.code:           wg set ${name} private-key ${privKey} ${
              optionalString (values.listenPort != null) " listen-port ${toString values.listenPort}"}
  
            ip link set up dev ${name}
  
            ${values.postSetup}
          '';
  