anchor.diff:  
     mkSubModule = { name, port, extraOpts, imports }: {
       ${name} = mkOption {
  -      type = types.submodule {
  +      type = types.submodule [{
           inherit imports;
           options = (mkExporterOpts {
             inherit name port;
           } // extraOpts);
  -      };
  +      } ({ config, ... }: mkIf config.openFirewall {
  +        firewallFilter = mkOptionDefault "-p tcp -m tcp --dport ${toString config.port}";
  +      })];
         internal = true;
         default = {};
       };
  
positive.code:       '';
      };
      firewallFilter = mkOption {
        type = types.str;
        default = "-p tcp -m tcp --dport ${toString cfg.${name}.port}";
        defaultText = "-p tcp -m tcp --dport ${toString port}";
        example = literalExample ''
          "-i eth0 -p tcp -m tcp --dport ${toString port}"
        '';
  
negative.code:         Please specify either 'services.prometheus.exporters.sql.configuration' or
            'services.prometheus.exporters.sql.configFile'
        '';
      } ] ++ (flip map (attrNames cfg) (exporter: {
        assertion = cfg.${exporter}.firewallFilter != null -> cfg.${exporter}.openFirewall;
        message = ''
          The `firewallFilter'-option of exporter ${exporter} doesn't have any effect unless
          `openFirewall' is set to `true'!
        '';
      }));
    }] ++ [(mkIf config.services.minio.enable {
      services.prometheus.exporters.minio.minioAddress  = mkDefault "http://localhost:9000";
      services.prometheus.exporters.minio.minioAccessKey = mkDefault config.services.minio.accessKey;
  