anchor.diff:      secret=$(cat "${keyOptions.keyFile}")
       dest="${stateDir}/private/${keyName}"
       echo "  secret: \"$secret\"" > "$dest"
  -    ${pkgs.coreutils}/bin/chown ${username}:${username} "$dest"
  -    ${pkgs.coreutils}/bin/chmod 0400 "$dest"
  +    chown ${username}:${username} "$dest"
  +    chmod 0400 "$dest"
     '') cfg.keys);
   
   
  
positive.code:       ipv4-edns-size:      ${toString cfg.ipv4EDNSSize}
        do-ip6:              ${yesOrNo  cfg.ipv6}
        ipv6-edns-size:      ${toString cfg.ipv6EDNSSize}
        log-time-asci:       ${yesOrNo  cfg.logTimeAscii}
        ${maybeString "nsid: " cfg.nsid}
        port:                ${toString cfg.port}
        reuseport:           ${yesOrNo  cfg.reuseport}
  
negative.code: 
      systemd.services.nsd = {
        description = "NSD authoritative only domain name service";
  
        after = [ "keys.target" "network.target" ];
        wantedBy = [ "multi-user.target" ];
        wants = [ "keys.target" ];
  
        serviceConfig = {
          ExecStart = "${nsdPkg}/sbin/nsd -d -c ${nsdEnv}/nsd.conf";
          PIDFile = pidFile;
          Restart = "always";
          RestartSec = "4s";
          StartLimitBurst = 4;
          StartLimitInterval = "5min";
        };
  
        preStart = ''
          rm -Rf "${stateDir}/private/"
          rm -Rf "${stateDir}/tmp/"
  
          mkdir -m 0700 -p "${stateDir}/private"
          mkdir -m 0700 -p "${stateDir}/tmp"
          mkdir -m 0700 -p "${stateDir}/var"
  
          cat > "${stateDir}/don't touch anything in here" << EOF
          Everything in this directory except NSD's state in var is
          automatically generated and will be purged and redeployed
          by the nsd.service pre-start script.
          EOF
  
          chown ${username}:${username} -R "${stateDir}/private"
          chown ${username}:${username} -R "${stateDir}/tmp"
          chown ${username}:${username} -R "${stateDir}/var"
  
          rm -rf "${stateDir}/zones"
          cp -rL "${nsdEnv}/zones" "${stateDir}/zones"
  
          ${copyKeys}
        '';
  