anchor.diff:      + concatMapStrings (mkListen "doh2") cfg.listenDoH
       + cfg.extraConfig
     );
  -
  -  package = pkgs.knot-resolver;
   in {
     meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
   
  
positive.code:       };
      users.groups.knot-resolver.gid = null;
  
      systemd.packages = [ package ]; # the units are patched inside the package a bit
  
      systemd.targets.kresd = { # configure units started by default
        wantedBy = [ "multi-user.target" ];
  
negative.code:         ++ map (i: "kresd@${toString i}.service") (range 1 cfg.instances);
      };
      systemd.services."kresd@".serviceConfig = {
        ExecStart = "${cfg.package}/bin/kresd --noninteractive "
          + "-c ${cfg.package}/lib/knot-resolver/distro-preconfig.lua -c ${configFile}";
        # Ensure /run/knot-resolver exists
        RuntimeDirectory = "knot-resolver";
        RuntimeDirectoryMode = "0770";
  