anchor.diff:  
     confFile = pkgs.writeText "unbound.conf" ''
       server:
  +      ip-freebind: yes
         directory: "${stateDir}"
         username: unbound
  -      chroot: "${stateDir}"
  +      chroot: ""
         pidfile: ""
  +      # when running under systemd there is no need to daemonize
  +      do-daemonize: no
         ${interfaces}
         ${access}
         ${trustAnchor}
       ${cfg.extraConfig}
       ${forward}
     '';
  -
   in
  -
   {
   
     ###### interface
  
positive.code: 
      networking.resolvconf.useLocalResolver = mkDefault true;
  
      systemd.services.unbound = {
        description = "Unbound recursive Domain Name Server";
        after = [ "network.target" ];
  
negative.code:       interfaces = mkOption {
          default = [ "127.0.0.1" ] ++ optional config.networking.enableIPv6 "::1";
          type = types.listOf types.str;
          description =  ''
            What addresses the server should listen on. This supports the interface syntax documented in
            <citerefentry><refentrytitle>unbound.conf</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
          '';
        };
  
        forwardAddresses = mkOption {
          default = [];
          type = types.listOf types.str;
          description = "What servers to forward queries to.";
        };
  