anchor.diff:  
     imports = [
       (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
  +
  +    (mkChangedOptionModule
  +      [ "services" "dnscrypt-proxy" "tcpOnly" ]
  +      [ "services" "dnscrypt-proxy" "extraArgs" ]
  +      (config:
  +        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
  +        optional val "-T"))
  +
  +    (mkChangedOptionModule
  +      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
  +      [ "services" "dnscrypt-proxy" "extraArgs" ]
  +      (config:
  +        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
  +        optional val "-E"))
     ];
   }
  
positive.code:     sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
    };
  
    # Internal flag indicating whether the upstream resolver list is used
    useUpstreamResolverList = cfg.resolverList == null && cfg.customResolver == null;
  
    resolverList =
      if (cfg.resolverList != null)
        then cfg.resolverList
        else "${stateDirectory}/dnscrypt-resolvers.csv";
  
    resolverArgs = if (cfg.customResolver != null)
      then
        [ "--resolver-address=${cfg.customResolver.address}:${toString cfg.customResolver.port}"
          "--provider-name=${cfg.customResolver.name}"
          "--provider-key=${cfg.customResolver.key}"
        ]
      else
        [ "--resolvers-list=${resolverList}"
          "--resolver-name=${cfg.resolverName}"
        ];
  
    # The final command line arguments passed to the daemon
    daemonArgs =
      [ "--local-address=${localAddress}" ]
      ++ optional cfg.tcpOnly "--tcp-only"
      ++ optional cfg.ephemeralKeys "-E"
      ++ resolverArgs;
  in
  
  {
  
negative.code:   };
  
    options = {
      # Before adding another option, consider whether it could
      # equally well be passed via extraArgs.
  
      services.dnscrypt-proxy = {
        enable = mkOption {
          default = false;
  