anchor.diff:  
       services.dnschain = {
   
  -      enable = mkOption {
  -        type = types.bool;
  -        default = false;
  +      enable = mkEnableOption ''
  +        DNSChain, a blockchain based DNS + HTTP server.
  +        To resolve .bit domains set <literal>services.namecoind.enable = true;</literal>
  +        and an RPC username/password.
  +      '';
  +
  +      dns.address = mkOption {
  +        type = types.str;
  +        default = "127.0.0.1";
           description = ''
  -          Whether to run dnschain. That implies running
  -          namecoind as well, so make sure to configure
  -          it appropriately.
  +          The IP address that will be used to reach this machine.
  +          Leave this unchanged if you do not wish to directly expose the DNSChain resolver.
  +        '';
  +      };
  +
  +      dns.port = mkOption {
  +        type = types.int;
  +        default = 5333;
  +        description = ''
  +          The port the DNSChain resolver will bind to.
  +        '';
  +      };
  +
  +      api.hostname = mkOption {
  +        type = types.str;
  +        default = "0.0.0.0";
  +        description = ''
  +          The hostname (or IP address) the DNSChain API server will bind to.
  +        '';
  +      };
  +
  +      api.port = mkOption {
  +        type = types.int;
  +        default = 8080;
  +        description = ''
  +          The port the DNSChain API server (HTTP) will bind to.
  +        '';
  +      };
  +
  +      api.tlsPort = mkOption {
  +        type = types.int;
  +        default = 4433;
  +        description = ''
  +          The port the DNSChain API server (HTTPS) will bind to.
  +        '';
  +      };
  +
  +      extraConfig = mkOption {
  +        type = types.lines;
  +        default = "";
  +        example = ''
  +          [log]
  +          level = debug
  +        '';
  +        description = ''
  +          Additional options that will be appended to the configuration file.
           '';
         };
   
       };
   
  -    services.dnsmasq = {
  -      resolveDnschainQueries = mkOption {
  -        type = types.bool;
  -        default = false;
  -        description = ''
  -          Resolve <literal>.bit</literal> top-level domains
  -          with dnschain and namecoind.
  -        '';
  -      };
  +    services.dnsmasq.resolveDNSChainQueries = mkOption {
  +      type = types.bool;
  +      default = false;
  +      description = ''
  +        Resolve <literal>.bit</literal> top-level domains using DNSChain and namecoin.
  +      '';
  +    };
   
  +    services.pdns-recursor.resolveDNSChainQueries = mkOption {
  +      type = types.bool;
  +      default = false;
  +      description = ''
  +        Resolve <literal>.bit</literal> top-level domains using DNSChain and namecoin.
  +      '';
       };
   
     };
  
positive.code: with lib;
  
  let
    cfg = config.services;
  
    dnschainConf = pkgs.writeText "dnschain.conf" ''
      [log]
      level=info
  
      [dns]
      host = 127.0.0.1
      port = 5333
      oldDNSMethod = NO_OLD_DNS
      # TODO: check what that address is acutally used for
      externalIP = 127.0.0.1
  
      [http]
      host = 127.0.0.1
      port=8088
      tlsPort=4443
    '';
  
  in
  
negative.code: 
    ###### implementation
  
    config = mkIf cfg.enable {
  
      services.dnsmasq.servers = optionals cfgs.dnsmasq.resolveDNSChainQueries
        [ "/.bit/127.0.0.1#${toString cfg.dns.port}"
          "/.dns/127.0.0.1#${toString cfg.dns.port}"
        ];
  
      services.pdns-recursor.forwardZones = mkIf cfgs.pdns-recursor.resolveDNSChainQueries
        { bit = "127.0.0.1:${toString cfg.dns.port}";
          dns = "127.0.0.1:${toString cfg.dns.port}";
        };
  
      users.extraUsers = singleton {
        name = username;
        description = "DNSChain daemon user";
        home = dataDir;
        createHome = true;
        uid = config.ids.uids.dnschain;
        extraGroups = optional cfgs.namecoind.enable "namecoin";
      };
  
      systemd.services.dnschain = {
        description = "DNSChain daemon";
        after    = optional cfgs.namecoind.enable "namecoind.target";
        wantedBy = [ "multi-user.target" ];
  
        serviceConfig = {
          User = "dnschain";
          Restart = "on-failure";
          ExecStart = "${pkgs.dnschain}/bin/dnschain";
        };
  
        preStart = ''
          # Link configuration file into dnschain home directory
          configPath=${dataDir}/.dnschain/dnschain.conf
          mkdir -p ${dataDir}/.dnschain
          if [ "$(realpath $configPath)" != "${configFile}" ]; then
            rm -f $configPath
            ln -s ${configFile} $configPath
          fi
        '';
      };
  
    };
  