anchor.diff:  { config, lib, pkgs, ... }:
   
   with lib;
  -
   let
  -
     cfg = config.services.unbound;
   
     stateDir = "/var/lib/unbound";
  
positive.code: 
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
        username: unbound
        chroot: "${stateDir}"
        pidfile: ""
        ${interfaces}
        ${access}
        ${trustAnchor}
      ${cfg.extraConfig}
      ${forward}
    '';
  
  in
  
  {
  
    ###### interface
  
negative.code: 
      networking.resolvconf.useLocalResolver = mkDefault true;
  
  
      environment.etc."unbound/unbound.conf".source = confFile;
  
      systemd.services.unbound = {
        description = "Unbound recursive Domain Name Server";
        after = [ "network.target" ];
  