anchor.diff:        '';
       };
   
  -    nixpkgs.config = mkIf dnssec {
  -      bind.enablePython = true;
  -    };
  -
       systemd.timers."nsd-dnssec" = mkIf dnssec {
         description = "Automatic DNSSEC key rollover";
   
  
positive.code:     ${concatStrings (mapAttrsToList signZone dnssecZones)}
    '';
    signZone = name: zone: ''
      ${pkgs.bind}/bin/dnssec-keymgr -g ${pkgs.bind}/bin/dnssec-keygen -s ${pkgs.bind}/bin/dnssec-settime -K ${stateDir}/dnssec -c ${policyFile name zone.dnssecPolicy} ${name}
      ${pkgs.bind}/bin/dnssec-signzone -S -K ${stateDir}/dnssec -o ${name} -O full -N date ${stateDir}/zones/${name}
      ${nsdPkg}/sbin/nsd-checkzone ${name} ${stateDir}/zones/${name}.signed && mv -v ${stateDir}/zones/${name}.signed ${stateDir}/zones/${name}
    '';
    policyFile = name: policy: pkgs.writeText "${name}.policy" ''
  
negative.code: 
    dnssec = length (attrNames dnssecZones) != 0; 
  
    dnssecTools = pkgs.bind.override { enablePython = true; };
  
    signZones = optionalString dnssec ''
      mkdir -p ${stateDir}/dnssec
      chown ${username}:${username} ${stateDir}/dnssec
  