anchor.diff:            extensions, and claims to not keep logs.
           '';
         };
  +
         resolverList = mkOption {
           description = ''
             The list of upstream DNSCrypt resolvers. By default, we use the most
  
positive.code:           TCP instead of UDP (on port 443). Use only if the UDP port is blocked.
          '';
        };
        ephemeralKeys = mkOption {
          default = false;
          type = types.bool;
  
negative.code:         type = types.nullOr (types.submodule ({ ... }: { options = {
            address = mkOption {
              type = types.str;
              description = "IP address";
              example = "208.67.220.220";
            };
  
            port = mkOption {
              type = types.int;
              description = "Port";
              default = 443;
            };
  
            name = mkOption {
              type = types.str;
              description = "Fully qualified domain name";
              example = "2.dnscrypt-cert.opendns.com";
            };
  
            key = mkOption {
              type = types.str;
              description = "Public key";
              example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
            };
          }; }));
        };
  
        tcpOnly = mkOption {
          default = false;
          type = types.bool;
  