anchor.diff:        preStart = ''
           mkdir -m 0755 -p ${stateDir}/dev/
           cp ${confFile} ${stateDir}/unbound.conf
  -        chown unbound ${stateDir}
  +        ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile}
  +        chown unbound ${stateDir} ${rootTrustAnchorFile}
           touch ${stateDir}/dev/random
           ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
         '';
  
positive.code:     "forward-zone:\n  name: .\n" +
      concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
  
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
  
negative.code:       pidfile: ""
        ${interfaces}
        ${access}
        ${trustAnchor}
      ${cfg.extraConfig}
      ${forward}
    '';
  