anchor.diff:  with lib;
   
   let
  -  cfg = config.services;
  +  cfgs = config.services;
  +  cfg  = cfgs.dnschain;
   
  -  dnschainConf = pkgs.writeText "dnschain.conf" ''
  +  dataDir  = "/var/lib/dnschain";
  +  username = "dnschain";
  +
  +  configFile = pkgs.writeText "dnschain.conf" ''
       [log]
  -    level=info
  +    level = info
   
       [dns]
  -    host = 127.0.0.1
  -    port = 5333
  +    host = ${cfg.dns.address}
  +    port = ${toString cfg.dns.port}
       oldDNSMethod = NO_OLD_DNS
  -    # TODO: check what that address is acutally used for
  -    externalIP = 127.0.0.1
  +    externalIP = ${cfg.dns.address}
   
       [http]
  -    host = 127.0.0.1
  -    port=8088
  -    tlsPort=4443
  +    host = ${cfg.api.hostname}
  +    port = ${toString cfg.api.port}
  +    tlsPort = ${toString cfg.api.tlsPort}
  +
  +    ${cfg.extraConfig}
     '';
   
   in
  
positive.code: 
      services.dnschain = {
  
        enable = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Whether to run dnschain. That implies running
            namecoind as well, so make sure to configure
            it appropriately.
          '';
        };
  
      };
  
      services.dnsmasq = {
        resolveDnschainQueries = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Resolve <literal>.bit</literal> top-level domains
            with dnschain and namecoind.
          '';
        };
  
      };
  
    };
  
negative.code: 
    ###### implementation
  
    config = mkIf cfg.enable {
  
      services.dnsmasq.servers = optionals cfgs.dnsmasq.resolveDNSChainQueries
        [ "/.bit/127.0.0.1#${toString cfg.dns.port}"
          "/.dns/127.0.0.1#${toString cfg.dns.port}"
        ];
  
      services.pdns-recursor.forwardZones = mkIf cfgs.pdns-recursor.resolveDNSChainQueries
        { bit = "127.0.0.1:${toString cfg.dns.port}";
          dns = "127.0.0.1:${toString cfg.dns.port}";
        };
  
      users.extraUsers = singleton {
        name = username;
        description = "DNSChain daemon user";
        home = dataDir;
        createHome = true;
        uid = config.ids.uids.dnschain;
        extraGroups = optional cfgs.namecoind.enable "namecoin";
      };
  
      systemd.services.dnschain = {
        description = "DNSChain daemon";
        after    = optional cfgs.namecoind.enable "namecoind.target";
        wantedBy = [ "multi-user.target" ];
  
        serviceConfig = {
          User = "dnschain";
          Restart = "on-failure";
          ExecStart = "${pkgs.dnschain}/bin/dnschain";
        };
  
        preStart = ''
          # Link configuration file into dnschain home directory
          configPath=${dataDir}/.dnschain/dnschain.conf
          mkdir -p ${dataDir}/.dnschain
          if [ "$(realpath $configPath)" != "${configFile}" ]; then
            rm -f $configPath
            ln -s ${configFile} $configPath
          fi
        '';
      };
  
    };
  