anchor.diff:        ips = [ "9.9.9.9" "149.112.112.112" ];
         url = "https://dns.quad9.net/dns-query";
       };
  +    opendns = {
  +      ips = [ "208.67.222.222" "208.67.220.220" ];
  +      url = "https://doh.opendns.com/dns-query";
  +    };
  +    custom = {
  +      inherit (cfg.provider) ips url;
  +    };
     };
   
     defaultProvider = "quad9";
   
     providerCfg =
  -    let
  -      isCustom = cfg.provider.kind == "custom";
  -    in
  -    lib.concatStringsSep " " [
  +    concatStringsSep " " [
         "-b"
  -      (concatStringsSep "," (if isCustom then cfg.provider.ips else providers."${cfg.provider.kind}".ips))
  +      (concatStringsSep "," providers."${cfg.provider.kind}".ips)
         "-r"
  -      (if isCustom then cfg.provider.url else providers."${cfg.provider.kind}".url)
  +      providers."${cfg.provider.kind}".url
       ];
   
   in
  
positive.code:           The upstream provider to use or custom in case you do not trust any of
            the predefined providers or just want to use your own.
  
            The default is ${defaultProvider} and there are privacy and security trade-offs
            when using any upstream provider. Please consider that before using any
            of them.
  
            If you pick a custom provider, you will need to provide the bootstrap
            IP addresses as well as the resolver https URL.
          '';
          type = types.enum ((builtins.attrNames providers) ++ [ "custom" ]);
          default = defaultProvider;
        };
  
  
negative.code:   config = lib.mkIf cfg.enable {
      systemd.services.https-dns-proxy = {
        description = "DNS to DNS over HTTPS (DoH) proxy";
        requires = [ "network.target" ];
        after = [ "network.target" ];
        wants = [ "nss-lookup.target" ];
        before = [ "nss-lookup.target" ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = rec {
          Type = "exec";
          DynamicUser = true;
          ProtectHome = "tmpfs";
          ExecStart = lib.concatStringsSep " " (
            [
              (lib.getExe pkgs.https-dns-proxy)
              "-a ${toString cfg.address}"
              "-p ${toString cfg.port}"
              "-l -"
  