anchor.diff:        }
       '';
   
  -  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
  -    "dhcpd${postfix}" = {
  -      description = "DHCPv${postfix} server";
  -      wantedBy = [ "multi-user.target" ];
  -      after = [ "network.target" ];
  -
  -      preStart = ''
  -        mkdir -m 755 -p ${cfg.stateDir}
  -        chown dhcpd:nogroup ${cfg.stateDir}
  -        touch ${cfg.stateDir}/dhcpd.leases
  -      '';
  -
  -      serviceConfig =
  -        let
  -          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
  -          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
  -                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
  -                   "-cf" "${configFile}"
  -                   "-lf" "${cfg.stateDir}/dhcpd.leases"
  -                   "-user" "dhcpd" "-group" "nogroup"
  -                 ] ++ cfg.extraFlags
  -                   ++ cfg.interfaces;
  -
  -        in {
  -          ExecStart = concatMapStringsSep " " escapeShellArg args;
  -          Type = "forking";
  -          Restart = "always";
  -          RuntimeDirectory = [ "dhcpd${postfix}" ];
  -          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
  +  dhcpdService = postfix: cfg:
  +    let
  +      configFile =
  +        if cfg.configFile != null
  +          then cfg.configFile
  +          else writeConfig cfg;
  +      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
  +      args = [
  +        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
  +        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
  +        "-cf" configFile
  +        "-lf" leaseFile
  +      ] ++ cfg.extraFlags
  +        ++ cfg.interfaces;
  +    in
  +      optionalAttrs cfg.enable {
  +        "dhcpd${postfix}" = {
  +          description = "DHCPv${postfix} server";
  +          wantedBy = [ "multi-user.target" ];
  +          after = [ "network.target" ];
  +
  +          preStart = "touch ${leaseFile}";
  +          serviceConfig = {
  +            ExecStart = concatMapStringsSep " " escapeShellArg args;
  +            Type = "forking";
  +            Restart = "always";
  +            DynamicUser = true;
  +            User = "dhcpd";
  +            Group = "dhcpd";
  +            AmbientCapabilities = [
  +              "CAP_NET_RAW"          # to send ICMP messages
  +              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
  +            ];
  +            StateDirectory   = "dhcpd${postfix}";
  +            RuntimeDirectory = "dhcpd${postfix}";
  +            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
  +          };
           };
  -    };
  -  };
  +      };
   
     machineOpts = { ... }: {
   
  
positive.code:       default = false;
        description = ''
          Whether to enable the DHCPv${postfix} server.
        '';
      };
  
      stateDir = mkOption {
        type = types.path;
        # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
        default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
        description = ''
          State directory for the DHCP server.
        '';
      };
  
  
negative.code: 
    config = mkIf (cfg4.enable || cfg6.enable) {
  
      systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;
  
    };
  