anchor.diff:              ${attrsToSection def.bondConfig}
   
             ''}
  +          ${optionalString (def.wireguardConfig != { }) ''
  +            [WireGuard]
  +            ${attrsToSection def.wireguardConfig}
  +
  +          ''}
  +          ${flip concatMapStrings def.wireguardPeers (x: ''
  +            [WireGuardPeer]
  +            ${attrsToSection x.wireguardPeerConfig}
  +
  +          '')}
             ${def.extraConfig}
           '';
       };
  
positive.code:       '';
      };
  
      vlanConfig = mkOption {
        default = {};
        example = { Id = "4"; };
  
negative.code:     (assertMacAddress "MACAddress")
    ];
  
    checkWireGuard = checkUnitConfig "WireGuard" [
      (assertOnlyFields [
        "PrivateKey" "PrivateKeyFile" "ListenPort" "FwMark"
      ])
      #(assertRange "ListenPort" 1 65535) # Or "auto"
    ];
  
    checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [
      (assertOnlyFields [
        "PublicKey" "PresharedKey" "AllowedIPs" "Endpoint" "PersistentKeepalive"
      ])
      # (assertRange "PersistentKeepalive" 1 65535) # defined as "nullOr int"
    ];
  
    checkVlan = checkUnitConfig "VLAN" [
      (assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
      (assertRange "Id" 0 4094)
  