anchor.diff:        '';
   
         serviceConfig = {
  -        ExecStart  = "${pkgs.bind.out}/sbin/named -u ${bindUser} ${optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} -f";
  +        ExecStart = "${pkgs.bind.out}/sbin/named -u ${bindUser} ${optionalString cfg.ipv4Only "-4"} -c ${cfg.configFile} -f";
           ExecReload = "${pkgs.bind.out}/sbin/rndc -k '/etc/bind/rndc.key' reload";
  -        ExecStop   = "${pkgs.bind.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
  +        ExecStop = "${pkgs.bind.out}/sbin/rndc -k '/etc/bind/rndc.key' stop";
         };
   
         unitConfig.Documentation = "man:named(8)";
  
positive.code:       };
  
        blockedNetworks = mkOption {
          default = [];
          type = types.listOf types.str;
          description = "
            What networks are just blocked.
  
negative.code:       enable = mkEnableOption "BIND domain name server";
  
        cacheNetworks = mkOption {
          default = [ "127.0.0.0/24" ];
          type = types.listOf types.str;
          description = "
            What networks are allowed to use us as a resolver.  Note
  