anchor.diff:        listenStreams = cfg.listenTLS;
         socketConfig = {
           FileDescriptorName = "tls";
  +        FreeBind = true;
  +        Service = "kresd.service";
  +      };
  +    };
  +
  +    systemd.sockets.kresd-doh = mkIf (cfg.listenDoH != []) rec {
  +      wantedBy = [ "sockets.target" ];
  +      before = wantedBy;
  +      partOf = [ "kresd.socket" ];
  +      listenStreams = cfg.listenDoH;
  +      socketConfig = {
  +        FileDescriptorName = "doh";
           FreeBind = true;
           Service = "kresd.service";
         };
  
positive.code: let
  
    cfg = config.services.kresd;
    package = pkgs.knot-resolver;
  
    configFile = pkgs.writeText "kresd.conf" cfg.extraConfig;
  in
  
  {
    meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
  
    imports = [
  
negative.code:         For detailed syntax see ListenStream in man systemd.socket.
        '';
      };
      listenDoH = mkOption {
        type = with types; listOf str;
        default = [];
        example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
        description = ''
          Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
          For detailed syntax see ListenStream in man systemd.socket.
        '';
      };
      # TODO: perhaps options for more common stuff like cache size or forwarding
    };
  
  