anchor.diff:          Type = "notify";
           WorkingDirectory = cfg.cacheDir;
           Restart = "on-failure";
  +        Sockets = [ "kresd.socket" "kresd-control.socket" ]
  +          ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
         };
   
         # Trust anchor goes from dns-root-data by default.
  
positive.code:         What addresses the server should listen on. (UDP+TCP 53)
        '';
      };
      # TODO: perhaps options for more common stuff like cache size or forwarding
    };
  
  
negative.code:       socketConfig.FreeBind = true;
      };
  
      systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
        wantedBy = [ "sockets.target" ];
        before = wantedBy;
        partOf = [ "kresd.socket" ];
        listenStreams = cfg.listenTLS;
        socketConfig = {
          FileDescriptorName = "tls";
          FreeBind = true;
          Service = "kresd.service";
        };
      };
  
      systemd.sockets.kresd-control = rec {
        wantedBy = [ "sockets.target" ];
        before = wantedBy;
  