anchor.diff:  in
   {
     imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ];
  +
  +  # https://cloud.google.com/compute/docs/tutorials/building-images
  +  networking.firewall.enable = lib.mkDefault false;
   
     system.build.googleComputeImage =
       pkgs.vmTools.runInLinuxVM (
  
positive.code: 
    boot.kernelParams = [ "console=ttyS0" "panic=1" "boot.panic_on_fail" ];
    boot.initrd.kernelModules = [ "virtio_scsi" ];
  
    # Generate a GRUB menu.  Amazon's pv-grub uses this to boot our kernel/initrd.
    boot.loader.grub.device = "/dev/sda";
  
negative.code:   # at instance creation time.
    services.openssh.enable = true;
    services.openssh.permitRootLogin = "without-password";
    services.openssh.passwordAuthentication = false;
  
    # Force getting the hostname from Google Compute.
    networking.hostName = mkDefault "";
  