anchor.diff:      sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
     };
   
  -  # Internal flag indicating whether the upstream resolver list is used
  +  # Internal flag indicating whether the upstream resolver list is used.
     useUpstreamResolverList = cfg.resolverList == null && cfg.customResolver == null;
   
  +  # The final local address.
  +  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
  +
  +  # The final resolvers list path.
     resolverList =
       if (cfg.resolverList != null)
         then cfg.resolverList
         else "${stateDirectory}/dnscrypt-resolvers.csv";
   
  -  resolverArgs = if (cfg.customResolver != null)
  -    then
  -      [ "--resolver-address=${cfg.customResolver.address}:${toString cfg.customResolver.port}"
  -        "--provider-name=${cfg.customResolver.name}"
  -        "--provider-key=${cfg.customResolver.key}"
  -      ]
  -    else
  -      [ "--resolvers-list=${resolverList}"
  -        "--resolver-name=${cfg.resolverName}"
  -      ];
  -
  -  # The final command line arguments passed to the daemon
  +  # Build daemon command line
  +
  +  resolverArgs =
  +    if (cfg.customResolver == null)
  +      then
  +        [ "-L ${resolverList}"
  +          "-R ${cfg.resolverName}"
  +        ]
  +      else with cfg.customResolver;
  +        [ "-N ${name}"
  +          "-k ${key}"
  +          "-r ${address}:${toString port}"
  +        ];
  +
     daemonArgs =
  -    [ "--local-address=${localAddress}" ]
  -    ++ optional cfg.tcpOnly "--tcp-only"
  -    ++ optional cfg.ephemeralKeys "-E"
  -    ++ resolverArgs;
  +       [ "-a ${localAddress}" ]
  +    ++ resolverArgs
  +    ++ cfg.extraArgs;
   in
   
   {
  
positive.code:   cfg = config.services.dnscrypt-proxy;
  
    stateDirectory = "/var/lib/dnscrypt-proxy";
  
    localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
  
    # The minisign public key used to sign the upstream resolver list.
    # This is somewhat more flexible than preloading the key as an
  
negative.code: 
    imports = [
      (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
  
      (mkChangedOptionModule
        [ "services" "dnscrypt-proxy" "tcpOnly" ]
        [ "services" "dnscrypt-proxy" "extraArgs" ]
        (config:
          let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
          optional val "-T"))
  
      (mkChangedOptionModule
        [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
        [ "services" "dnscrypt-proxy" "extraArgs" ]
        (config:
          let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
          optional val "-E"))
    ];
  }
  