anchor.diff:    cfg = config.services.dnscrypt-proxy;
     uid = config.ids.uids.dnscrypt-proxy;
     daemonArgs =
  -    [ "--daemonize"
  -      "--user=dnscrypt-proxy"
  +    [ "--user=dnscrypt-proxy"
         "--local-address=${cfg.localAddress}:${toString cfg.port}"
         (optionalString cfg.tcpOnly "--tcp-only")
         "--resolvers-list=${dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv"
  
positive.code: 
      ### Service definition
  
      systemd.services.dnscrypt-proxy = {
        description = "dnscrypt-proxy daemon";
        after = [ "network.target" ] ++ optional apparmorEnabled "apparmor.service";
        requires = mkIf apparmorEnabled [ "apparmor.service" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
          Type = "forking";
          ExecStart = "${dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
        };
      };
  
negative.code:           ${dnscrypt-proxy}/share/dnscrypt-proxy/** r,
            ${pkgs.gcc.cc}/lib/libssp.so.* mr,
            ${pkgs.libsodium}/lib/libsodium.so.* mr,
            ${pkgs.systemd}/lib/libsystemd.so.* mr,
            ${pkgs.xz}/lib/liblzma.so.* mr,
            ${pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
            ${pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
          }
        '')
      ];
  