anchor.diff:        pidfile: ""
         ${interfaces}
         ${access}
  +      ${trustAnchor}
       ${cfg.extraConfig}
       ${forward}
     '';
  
positive.code:     "forward-zone:\n  name: .\n" +
      concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
  
    confFile = pkgs.writeText "unbound.conf" ''
      server:
        directory: "${stateDir}"
  
negative.code:         description = "What servers to forward queries to.";
        };
  
        enableRootTrustAnchor = mkOption {
          default = true;
          type = types.bool;
          description = "Use and update root trust anchor for DNSSEC validation.";
        };
  
        extraConfig = mkOption {
          default = "";
          type = types.str;
  