anchor.diff:  { config, lib, pkgs, ...}:
  +
  +with lib;
  +
   let
     cfg = config.services.varnish;
   
  +  commandLine = "-f ${pkgs.writeText "default.vcl" cfg.config}" +
  +      optionalString (cfg.extraModules != []) " -p vmod_path='${makeSearchPathOutput "lib" "lib/varnish/vmods" ([pkgs.varnish] ++ cfg.extraModules)}' -r vmod_path";
   in
  -with lib;
   {
     options = {
       services.varnish = {
  
positive.code:       serviceConfig = {
          Type = "simple";
          PermissionsStartOnly = true;
          ExecStart = "${pkgs.varnish}/sbin/varnishd -a ${cfg.http_address} -f ${pkgs.writeText "default.vcl" cfg.config} -n ${cfg.stateDir} -F ${cfg.extraCommandLine}"
            + optionalString (cfg.extraModules != []) " -p vmod_path='${makeSearchPathOutput "lib" "lib/varnish/vmods" ([pkgs.varnish] ++ cfg.extraModules)}' -r vmod_path";
          Restart = "always";
          RestartSec = "5s";
          User = "varnish";
  
negative.code: 
      environment.systemPackages = [ pkgs.varnish ];
  
      # check .vcl syntax at compile time (e.g. before nixops deployment)
      system.extraDependencies = [
        (pkgs.stdenv.mkDerivation {
          name = "check-varnish-syntax";
          preferLocalBuild = true;
          buildCommand = "${pkgs.varnish}/sbin/varnishd -C ${commandLine} 2> $out";
        })
      ];
  
      users.extraUsers.varnish = {
        group = "varnish";
        uid = config.ids.uids.varnish;
  