anchor.diff:          description = "What servers to forward queries to.";
         };
   
  +      enableRootTrustAnchor = mkOption {
  +        default = true;
  +        type = types.bool;
  +        description = "Use and update root trust anchor for DNSSEC validation.";
  +      };
  +
         extraConfig = mkOption {
           default = "";
           type = types.str;
  
positive.code:       preStart = ''
          mkdir -m 0755 -p ${stateDir}/dev/
          cp ${confFile} ${stateDir}/unbound.conf
          chown unbound ${stateDir}
          touch ${stateDir}/dev/random
          ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
        '';
  
negative.code:     "forward-zone:\n  name: .\n" +
      concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
  
    rootTrustAnchorFile = "${stateDir}/root.key";
  
    trustAnchor = optionalString cfg.enableRootTrustAnchor
      "auto-trust-anchor-file: ${rootTrustAnchorFile}";
  
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
  