anchor.diff:        restartTriggers = [ config.environment.etc."ddclient.conf".source ];
   
         serviceConfig = {
  -        # Uncomment this if too many problems occur:
  -        # Type = "forking";
  -        User = ddclientUser;
  -        Group = "nogroup"; #TODO get this to work
  -        PermissionsStartOnly = "true";
  -        PIDFile = ddclientPIDFile;
  -        ExecStartPre = ''
  -          ${pkgs.stdenv.shell} -c "${pkgs.coreutils}/bin/mkdir -m 0755 -p ${stateDir} && ${pkgs.coreutils}/bin/chown ${ddclientUser} ${stateDir}"
  -        '';
  -        ExecStart = "${ddclient}/bin/ddclient ${ddclientFlags}";
  -        #ExecStartPost = "${pkgs.coreutils}/bin/rm -r ${stateDir}"; # Should we have this?
  +        RuntimeDirectory = "ddclient";
  +        # we cannot run in forking mode as it swallows all the program output
  +        Type = "simple";
  +        User = "ddclient";
  +        Group = "ddclient";
  +        ExecStart = "${lib.getBin pkgs.ddclient}/bin/ddclient -foreground -file ${cfg.configFile}";
  +        ProtectSystem = "full";
  +        PrivateTmp = true;
         };
       };
     };
  
positive.code: { config, pkgs, lib, ... }:
  
  let
  
    inherit (lib) mkOption mkIf singleton;
    inherit (pkgs) ddclient;
  
    stateDir = "/var/spool/ddclient";
    ddclientUser = "ddclient";
    ddclientFlags = "-foreground -file ${config.services.ddclient.configFile}";
    ddclientPIDFile = "${stateDir}/ddclient.pid";
  
  in
  
  {
  
  
negative.code:         description = ''
            Password. WARNING: The password becomes world readable in the Nix store.
          '';
        };
  
        interval = mkOption {
          default = 600;
          type = int;
          description = "The interval at which to run the check and update.";
        };
  
        configFile = mkOption {
  