anchor.diff:          ProtectKernelTunables = true;
           ProtectControlGroups = true;
           RestrictAddressFamilies =
  -          optionals (conf.bind != null) ["AF_INET" "AF_INET6"] ++
  +          optionals (conf.port != 0) ["AF_INET" "AF_INET6"] ++
             optional (conf.unixSocket != null) "AF_UNIX";
           RestrictNamespaces = true;
           LockPersonality = true;
  
positive.code:             unixSocket = mkOption {
                type = with types; nullOr path;
                default = "/run/${redisName name}/redis.sock";
                defaultText = "\"/run/redis/redis.sock\" or \"/run/redis-\${name}/redis.sock\" if name != \"\"";
                description = "The path to the socket to bind to.";
              };
  
  
negative.code:             user = mkOption {
                type = types.str;
                default = redisName name;
                defaultText = literalExpression ''
                  if name == "" then "redis" else "redis-''${name}"
                '';
                description = "The username and groupname for redis-server.";
              };
  
  