anchor.diff:      # randomizes addresses of mmap base, heap, stack and VDSO page
       "kernel.randomize_va_space" = mkDefault "2";
   
  +    # Reboot the machine soon after a kernel panic.
  +    "kernel.panic" = mkDefault "10";
  +
  +    ## Not part of the original config
  +
       # provides protection from ToCToU races
       "fs.protected_hardlinks" = mkDefault "1";
   
  
positive.code: with lib;
  let
    diskSize = 1024; # MB
  in
  {
    imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ./grow-partition.nix ];
  
    # https://cloud.google.com/compute/docs/tutorials/building-images
    networking.firewall.enable = mkDefault false;
  
    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
      name = "google-compute-image";
  
negative.code:       serviceConfig.StandardOutput = "journal+console";
      };
  
    # Settings taken from https://github.com/GoogleCloudPlatform/compute-image-packages/blob/master/google_config/sysctl/11-gce-network-security.conf
    boot.kernel.sysctl = {
      # Turn on SYN-flood protections.  Starting with 2.6.26, there is no loss
      # of TCP functionality/features under normal conditions.  When flood
      # protections kick in under high unanswered-SYN load, the system
      # should remain more stable, with a trade off of some loss of TCP
      # functionality/features (e.g. TCP Window scaling).
      "net.ipv4.tcp_syncookies" = mkDefault "1";
  
      # ignores source-routed packets
  