anchor.diff:    cfg = config.services.dnscrypt-proxy;
   
     stateDirectory = "/var/lib/dnscrypt-proxy";
  -
  -  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
   
     # The minisign public key used to sign the upstream resolver list.
     # This is somewhat more flexible than preloading the key as an
  
positive.code:         }; }));
        };
  
        tcpOnly = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Force sending encrypted DNS queries to the upstream resolver over
            TCP instead of UDP (on port 443). Use only if the UDP port is blocked.
          '';
        };
  
        ephemeralKeys = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Compute a new key pair for every query.  Enabling this option
            increases CPU usage, but makes it more difficult for the upstream
            resolver to track your usage of their service across IP addresses.
            The default is to re-use the public key pair for all queries, making
            tracking trivial.
          '';
        };
      };
  
negative.code: 
    imports = [
      (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
  
      (mkChangedOptionModule
        [ "services" "dnscrypt-proxy" "tcpOnly" ]
        [ "services" "dnscrypt-proxy" "extraArgs" ]
        (config:
          let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
          optional val "-T"))
  
      (mkChangedOptionModule
        [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
        [ "services" "dnscrypt-proxy" "extraArgs" ]
        (config:
          let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
          optional val "-E"))
    ];
  }
  