anchor.diff:          mkdir -m 0755 -p ${stateDir}/dev/
           cp ${confFile} ${stateDir}/unbound.conf
           ${optionalString cfg.enableRootTrustAnchor ''
  -        ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
  -        chown unbound ${stateDir} ${rootTrustAnchorFile}
  +          ${pkgs.unbound}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
  +          chown unbound ${stateDir} ${rootTrustAnchorFile}
           ''}
           touch ${stateDir}/dev/random
           ${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random
  
positive.code:       };
  
        interfaces = mkOption {
          default = [ "127.0.0.1" "::1" ];
          type = types.listOf types.str;
          description = "What addresses the server should listen on.";
        };
  
negative.code:         ProtectSystem = true;
          ProtectHome = true;
          PrivateDevices = true;
          Restart = "always";
          RestartSec = "5s";
        };
      };
  
  