anchor.diff:  with lib;
   
   let
  -  dataDir  = "/var/lib/pdns-recursor";
  -  username = "pdns-recursor";
  -
     cfg = config.services.pdns-recursor;
   
     oneOrMore  = type: with types; either type (listOf type);
  
positive.code:       serve-rfc1918    = cfg.serveRFC1918;
        lua-config-file  = pkgs.writeText "recursor.lua" cfg.luaConfig;
  
        log-timestamp  = false;
        disable-syslog = true;
      };
  
      users.users.${username} = {
        home = dataDir;
        createHome = true;
        uid = config.ids.uids.pdns-recursor;
        description = "PowerDNS Recursor daemon user";
      };
  
      systemd.services.pdns-recursor = {
        unitConfig.Documentation = "man:pdns_recursor(1) man:rec_control(1)";
        description = "PowerDNS recursive server";
        wantedBy = [ "multi-user.target" ];
        after    = [ "network.target" ];
  
        serviceConfig = {
          User = username;
          Restart    ="on-failure";
          RestartSec = "5";
          PrivateTmp = true;
          PrivateDevices = true;
          AmbientCapabilities = "cap_net_bind_service";
          ExecStart = ''${pkgs.pdns-recursor}/bin/pdns_recursor \
            --config-dir=${dataDir} \
            --socket-dir=${dataDir}
          '';
        };
  
        preStart = ''
          # Link configuration file into recursor home directory
          configPath=${dataDir}/recursor.conf
          if [ "$(realpath $configPath)" != "${configFile}" ]; then
            rm -f $configPath
            ln -s ${configFile} $configPath
          fi
        '';
      };
    };
  
    imports = [
  
negative.code:     else if builtins.isList val then (concatMapStringsSep "," serialize val)
      else "";
  
    configDir = pkgs.writeTextDir "recursor.conf"
      (concatStringsSep "\n"
        (flip mapAttrsToList cfg.settings
          (name: val: "${name}=${serialize val}")));
  