anchor.diff:      };
       }
   
  -    (mkIf apparmorEnabled {
  +    (mkIf config.security.apparmor.enable {
  +    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
  +
       security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
         ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
           /dev/null rw,
  
positive.code:       documentation = [ "man:dnscrypt-proxy(8)" ];
  
        before = [ "nss-lookup.target" ];
  
        after = [ "network.target" ]
          ++ optional apparmorEnabled "apparmor.service";
  
        requires = [ "dnscrypt-proxy.socket "]
          ++ optional apparmorEnabled "apparmor.service";
  
        serviceConfig = {
          NonBlocking = "true";
  
negative.code: with lib;
  
  let
    cfg = config.services.dnscrypt-proxy;
  
    stateDirectory = "/var/lib/dnscrypt-proxy";
  