anchor.diff:  let
   
     cfg = config.services.unbound;
  -
  -  username = "unbound";
   
     stateDir = "/var/lib/unbound";
   
  
positive.code:   confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
        username: ${username}
        # make sure unbound can access entropy from inside the chroot.
        # e.g. on linux the use these commands (on BSD, devfs(8) is used):
        #      mount --bind -n /dev/random /etc/unbound/dev/random
        # and  mount --bind -n /dev/log /etc/unbound/dev/log
        chroot: "${stateDir}"
        # logfile: "${stateDir}/unbound.log"  #uncomment to use logfile.
        pidfile: "${stateDir}/unbound.pid"
        verbosity: 1      # uncomment and increase to get more logging.
        ${interfaces}
        ${access}
  
      ${forward}
  
      ${cfg.extraConfig}
    '';
  
  in
  
negative.code:     environment.systemPackages = [ pkgs.unbound ];
  
      users.extraUsers = singleton {
        name = "unbound";
        uid = config.ids.uids.unbound;
        description = "unbound daemon user";
        home = stateDir;
  