anchor.diff:        wants = [" nss-lookup.target" ];
         wantedBy = [ "multi-user.target" ];
   
  -      path = [ pkgs.unbound ];
  -      serviceConfig.ExecStart = "${pkgs.unbound}/sbin/unbound -d -c ${confFile}";
  +      preStart = ''
  +        mkdir -m 0755 -p ${stateDir}/dev/
  +	cp ${confFile} ${stateDir}/unbound.conf
  +	chown unbound ${stateDir}
  +	touch ${stateDir}/dev/random
  +        ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
  +      '';
  +
  +      serviceConfig = {
  +        ExecStart = "${pkgs.unbound}/sbin/unbound -d -c ${stateDir}/unbound.conf";
  +        ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random";
  +      };
       };
   
     };
  
positive.code:     environment.systemPackages = [ pkgs.unbound ];
  
      users.extraUsers = singleton {
        name = username;
        uid = config.ids.uids.unbound;
        description = "unbound daemon user";
        home = stateDir;
  
negative.code:   confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
        username: unbound
        chroot: "${stateDir}"
        pidfile: ""
        ${interfaces}
        ${access}
      ${cfg.extraConfig}
      ${forward}
    '';
  
  in
  