anchor.diff:      "forward-zone:\n  name: .\n" +
       concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
   
  +  rootTrustAnchorFile = "${stateDir}/root.key";
  +
  +  trustAnchor = optionalString cfg.enableRootTrustAnchor
  +    "auto-trust-anchor-file: ${rootTrustAnchorFile}";
  +
     confFile = pkgs.writeText "unbound.conf" ''
       server:
         directory: "${stateDir}"
  
positive.code:       pidfile: ""
        ${interfaces}
        ${access}
      ${cfg.extraConfig}
      ${forward}
    '';
  
negative.code:       preStart = ''
          mkdir -m 0755 -p ${stateDir}/dev/
          cp ${confFile} ${stateDir}/unbound.conf
          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile}
          chown unbound ${stateDir} ${rootTrustAnchorFile}
          touch ${stateDir}/dev/random
          ${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
        '';
  