anchor.diff:  let
   
     cfg = config.services.kresd;
  -  package = pkgs.knot-resolver;
  +  configFile = pkgs.writeText "kresd.conf" ''
  +    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
  +    ${cfg.extraConfig};
  +  '';
   
  -  configFile = pkgs.writeText "kresd.conf" cfg.extraConfig;
  -in
  -
  -{
  +  package = pkgs.knot-resolver.override {
  +    extraFeatures = cfg.listenDoH != [];
  +  };
  +in {
     meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
   
     imports = [
  
positive.code:         For detailed syntax see ListenStream in man systemd.socket.
        '';
      };
      # TODO: perhaps options for more common stuff like cache size or forwarding
    };
  
  
negative.code:       listenStreams = cfg.listenTLS;
        socketConfig = {
          FileDescriptorName = "tls";
          FreeBind = true;
          Service = "kresd.service";
        };
      };
  
      systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
        wantedBy = [ "sockets.target" ];
        before = wantedBy;
        partOf = [ "kresd.socket" ];
        listenStreams = cfg.listenDoH;
        socketConfig = {
          FileDescriptorName = "doh";
          FreeBind = true;
          Service = "kresd.service";
        };
  