anchor.diff:    forward =
       optionalString (any isLocalAddress cfg.forwardAddresses) ''
         do-not-query-localhost: no
  -    '' +
  -    optionalString (cfg.forwardAddresses != []) ''
  +    ''
  +    + optionalString (cfg.forwardAddresses != []) ''
         forward-zone:
           name: .
  -    '' +
  -    concatMapStringsSep "\n" (x: "    forward-addr: ${x}") cfg.forwardAddresses;
  +    ''
  +    + concatMapStringsSep "\n" (x: "    forward-addr: ${x}") cfg.forwardAddresses;
   
     rootTrustAnchorFile = "${stateDir}/root.key";
   
  
positive.code: 
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
        username: unbound
        chroot: "${stateDir}"
        pidfile: ""
        ${interfaces}
        ${access}
        ${trustAnchor}
      ${cfg.extraConfig}
      ${forward}
    '';
  
  in
  
  {
  
    ###### interface
  
negative.code: 
      networking.resolvconf.useLocalResolver = mkDefault true;
  
  
      environment.etc."unbound/unbound.conf".source = confFile;
  
      systemd.services.unbound = {
        description = "Unbound recursive Domain Name Server";
        after = [ "network.target" ];
  