anchor.diff:          AmbientCapabilities = "cap_net_bind_service";
           ExecStart = ''${pkgs.pdns-recursor}/bin/pdns_recursor \
             --config-dir=${dataDir} \
  -          --socket-dir=${dataDir} \
  -          --disable-syslog
  +          --socket-dir=${dataDir}
           '';
         };
   
  
positive.code:   dataDir  = "/var/lib/pdns-recursor";
    username = "pdns-recursor";
  
    cfg   = config.services.pdns-recursor;
    zones = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
  
    configFile = pkgs.writeText "recursor.conf" ''
      local-address=${cfg.dns.address}
      local-port=${toString cfg.dns.port}
      allow-from=${concatStringsSep "," cfg.dns.allowFrom}
  
      webserver-address=${cfg.api.address}
      webserver-port=${toString cfg.api.port}
      webserver-allow-from=${concatStringsSep "," cfg.api.allowFrom}
  
      forward-zones=${concatStringsSep "," zones}
      export-etc-hosts=${if cfg.exportHosts then "yes" else "no"}
      dnssec=${cfg.dnssecValidation}
      serve-rfc1918=${if cfg.serveRFC1918 then "yes" else "no"}
  
      ${cfg.extraConfig}
    '';
  
  in {
    options.services.pdns-recursor = {
  
negative.code:       '';
      };
  
      settings = mkOption {
        type = configType;
        default = { };
        example = literalExample ''
          {
            loglevel = 8;
            log-common-errors = true;
          }
        '';
        description = ''
          PowerDNS Recursor settings. Use this option to configure Recursor
          settings not exposed in a NixOS option or to bypass one.
          See the full documentation at
          <link xlink:href="https://doc.powerdns.com/recursor/settings.html"/>
          for the available options.
        '';
      };
  
    };
  
    config = mkIf cfg.enable {
  
      services.pdns-recursor.settings = mkDefaultAttrs {
        local-address = cfg.dns.address;
        local-port    = cfg.dns.port;
        allow-from    = cfg.dns.allowFrom;
  
        webserver-address    = cfg.api.address;
        webserver-port       = cfg.api.port;
        webserver-allow-from = cfg.api.allowFrom;
  
        forward-zones    = mapAttrsToList (zone: uri: "${zone}.=${uri}") cfg.forwardZones;
        export-etc-hosts = cfg.exportHosts;
        dnssec           = cfg.dnssecValidation;
        serve-rfc1918    = cfg.serveRFC1918;
  
        log-timestamp  = false;
        disable-syslog = true;
      };
  
      users.users."${username}" = {
        home = dataDir;
  