anchor.diff:        '';
       };
     };
  +
  +  imports = [
  +   (mkRemovedOptionModule [ "services" "pdns-recursor" "extraConfig" ]
  +     "To change extra Recursor settings use services.pdns-recursor.settings instead.")
  +  ];
  +
   }
  
positive.code:         AmbientCapabilities = "cap_net_bind_service";
          ExecStart = ''${pkgs.pdns-recursor}/bin/pdns_recursor \
            --config-dir=${dataDir} \
            --socket-dir=${dataDir} \
            --disable-syslog
          '';
        };
  
  
negative.code:   dataDir  = "/var/lib/pdns-recursor";
    username = "pdns-recursor";
  
    cfg = config.services.pdns-recursor;
  
    oneOrMore  = type: with types; either type (listOf type);
    valueType  = with types; oneOf [ int str bool path ];
    configType = with types; attrsOf (nullOr (oneOrMore valueType));
  
    toBool    = val: if val then "yes" else "no";
    serialize = val: with types;
           if str.check       val then val
      else if int.check       val then toString val
      else if path.check      val then toString val
      else if bool.check      val then toBool val
      else if builtins.isList val then (concatMapStringsSep "," serialize val)
      else "";
  
    configFile = pkgs.writeText "recursor.conf"
      (concatStringsSep "\n"
        (flip mapAttrsToList cfg.settings
          (name: val: "${name}=${serialize val}")));
  
    mkDefaultAttrs = mapAttrs (n: v: mkDefault v);
  
  in {
    options.services.pdns-recursor = {
  