anchor.diff:  let
   
     cfg = config.services.kresd;
  -  package = pkgs.knot-resolver;
  +  configFile = pkgs.writeText "kresd.conf" ''
  +    ${optionalString (cfg.listenDoH != []) "modules.load('http')"}
  +    ${cfg.extraConfig};
  +  '';
   
  -  configFile = pkgs.writeText "kresd.conf" cfg.extraConfig;
  -in
  -
  -{
  +  package = pkgs.knot-resolver.override {
  +    extraFeatures = cfg.listenDoH != [];
  +  };
  +in {
     meta.maintainers = [ maintainers.vcunat /* upstream developer */ ];
   
     imports = [
  
positive.code:       listenStreams = cfg.listenTLS;
        socketConfig = {
          FileDescriptorName = "tls";
          FreeBind = true;
          Service = "kresd.service";
        };
  
negative.code:         For detailed syntax see ListenStream in man systemd.socket.
        '';
      };
      listenDoH = mkOption {
        type = with types; listOf str;
        default = [];
        example = [ "198.51.100.1:443" "[2001:db8::1]:443" "443" ];
        description = ''
          Addresses and ports on which kresd should provide DNS over HTTPS (see RFC 7858).
          For detailed syntax see ListenStream in man systemd.socket.
        '';
      };
      # TODO: perhaps options for more common stuff like cache size or forwarding
    };
  
  