anchor.diff:        pidfile: ""
         ${interfaces}
         ${access}
  +      ${trustAnchor}
       ${cfg.extraConfig}
       ${forward}
     '';
  
positive.code:     "forward-zone:\n  name: .\n" +
      concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
  
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
  
negative.code:       preStart = ''
          mkdir -m 0755 -p ${stateDir}/dev/
          cp ${confFile} ${stateDir}/unbound.conf
          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile}
          chown unbound ${stateDir} ${rootTrustAnchorFile}
          touch ${stateDir}/dev/random
          ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
        '';
  