anchor.diff:          };
         };
         description = ''
  -        A set of connections and their options for the `conn xxx'
  -        sections of the `ipsec.conf' file.
  +        A set of connections and their options for the ‘conn xxx’
  +        sections of the <filename>ipsec.conf</filename> file.
         '';
       };
   
  
positive.code:       example = [ "/run/keys/ipsec-foo.secret" ];
        description = ''
          A list of paths to IPSec secret files. These
          files will be included into the main ipsec.secrets file
          with the `include' directive. It is safer if these paths are absolute.
        '';
      };
  
  
negative.code:         };
        };
        description = ''
          A set of CAs (certification authorities) and their options for
          the ‘ca xxx’ sections of the <filename>ipsec.conf</filename>
          file.
        '';
      };
    };
  
    config = with cfg; mkIf enable {
      systemd.services.strongswan = {
        description = "strongSwan IPSec Service";
        wantedBy = [ "multi-user.target" ];
        path = with pkgs; [ kmod ]; # XXX Linux
        wants = [ "keys.target" ];
  