anchor.diff:  
     childConfig = x: v: { options.children = { type = types.attrsOf x; visible = v; }; };
   
  -  zoneOptionsRaw = types.submodule (
  -    { options, ... }:
  -    { options = {
  -        children = mkOption {
  -            default     = {};
  -            description = ''
  -              Children zones inherit all options of their parents. Attributes
  -              defined in a child will overwrite the ones of its parent. Only
  -              leaf zones will be actually served. This way it's possible to
  -              define maybe zones which share most attributes without
  -              duplicating everything. This mechanism replaces nsd's patterns
  -              in a save and functional way.
  -            '';
  -        };
  -
  -        allowNotify = mkOption {
  -          type        = types.listOf types.str;
  -          default     = [ ];
  -          example     = [ "192.0.2.0/24 NOKEY" "10.0.0.1-10.0.0.5 my_tsig_key_name"
  -                           "10.0.3.4&255.255.0.0 BLOCKED"
  -                        ];
  -          description = ''
  -            Listed primary servers are allowed to notify this secondary server.
  -            <screen><![CDATA[
  -            Format: <ip> <key-name | NOKEY | BLOCKED>
  -
  -            <ip> either a plain IPv4/IPv6 address or range. Valid patters for ranges:
  -            * 10.0.0.0/24            # via subnet size
  -            * 10.0.0.0&255.255.255.0 # via subnet mask
  -            * 10.0.0.1-10.0.0.254    # via range
  -
  -            A optional port number could be added with a '@':
  -            * 2001:1234::1@1234
  -
  -            <key-name | NOKEY | BLOCKED>
  -            * <key-name> will use the specified TSIG key
  -            * NOKEY      no TSIG signature is required
  -            * BLOCKED    notifies from non-listed or blocked IPs will be ignored
  -            * ]]></screen>
  -          '';
  -        };
  -
  -        requestXFR = mkOption {
  -          type        = types.listOf types.str;
  -          default     = [];
  -          example     = [];
  -          description = ''
  -            Format: <code>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</code>
  -          '';
  -        };
  -
  -        allowAXFRFallback = mkOption {
  -          type        = types.bool;
  -          default     = true;
  -          description = ''
  -            If NSD as secondary server should be allowed to AXFR if the primary
  -            server does not allow IXFR.
  -          '';
  -        };
  -
  -        notify = mkOption {
  -          type        = types.listOf types.str;
  -          default     = [];
  -          example     = [ "10.0.0.1@3721 my_key" "::5 NOKEY" ];
  -          description = ''
  -            This primary server will notify all given secondary servers about
  -            zone changes.
  -            <screen><![CDATA[
  -            Format: <ip> <key-name | NOKEY>
  -
  -            <ip> a plain IPv4/IPv6 address with on optional port number (ip@port)
  -
  -            <key-name | NOKEY>
  -            * <key-name> sign notifies with the specified key
  -            * NOKEY      don't sign notifies
  -            ]]></screen>
  -          '';
  -        };
  -
  -        notifyRetry = mkOption {
  -          type        = types.int;
  -          default     = 5;
  -          description = ''
  -            Specifies the number of retries for failed notifies. Set this along with notify.
  -          '';
  -        };
  -
  -        provideXFR = mkOption {
  -          type        = types.listOf types.str;
  -          default     = [];
  -          example     = [ "192.0.2.0/24 NOKEY" "192.0.2.0/24 my_tsig_key_name" ];
  -          description = ''
  -            Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
  -            address range 192.0.2.0/24, 1.2.3.4&amp;255.255.0.0, 3.0.2.20-3.0.2.40
  -          '';
  -        };
  -
  -        outgoingInterface = mkOption {
  -          type        = types.nullOr types.str;
  -          default     = null;
  -          example     = "2000::1@1234";
  -          description = ''
  -            This address will be used for zone-transfere requests if configured
  -            as a secondary server or notifications in case of a primary server.
  -            Supply either a plain IPv4 or IPv6 address with an optional port
  -            number (ip@port).
  -          '';
  -        };
  -
  -        rrlWhitelist = mkOption {
  -          type        = types.listOf types.str;
  -          default     = [];
  -          description = ''
  -            Whitelists the given rrl-types.
  -            The RRL classification types are:  nxdomain,  error, referral, any,
  -            rrsig, wildcard, nodata, dnskey, positive, all
  -          '';
  -        };
  -
  -        data = mkOption {
  -          type        = types.str;
  -          default     = "";
  -          example     = "";
  -          description = ''
  -            The actual zone data. This is the content of your zone file.
  -            Use imports or pkgs.lib.readFile if you don't want this data in your config file.
  -          '';
  -        };
  -
  -      };
  -    }
  -  );
  +  zoneOptionsRaw = types.submodule {
  +    options = {
  +      children = mkOption {
  +        default     = {};
  +        description = ''
  +          Children zones inherit all options of their parents. Attributes
  +          defined in a child will overwrite the ones of its parent. Only
  +          leaf zones will be actually served. This way it's possible to
  +          define maybe zones which share most attributes without
  +          duplicating everything. This mechanism replaces nsd's patterns
  +          in a save and functional way.
  +        '';
  +      };
  +
  +      allowNotify = mkOption {
  +        type        = types.listOf types.str;
  +        default     = [ ];
  +        example     = [ "192.0.2.0/24 NOKEY" "10.0.0.1-10.0.0.5 my_tsig_key_name"
  +                        "10.0.3.4&255.255.0.0 BLOCKED"
  +                      ];
  +        description = ''
  +          Listed primary servers are allowed to notify this secondary server.
  +          <screen><![CDATA[
  +          Format: <ip> <key-name | NOKEY | BLOCKED>
  +
  +          <ip> either a plain IPv4/IPv6 address or range. Valid patters for ranges:
  +          * 10.0.0.0/24            # via subnet size
  +          * 10.0.0.0&255.255.255.0 # via subnet mask
  +          * 10.0.0.1-10.0.0.254    # via range
  +
  +          A optional port number could be added with a '@':
  +          * 2001:1234::1@1234
  +
  +          <key-name | NOKEY | BLOCKED>
  +          * <key-name> will use the specified TSIG key
  +          * NOKEY      no TSIG signature is required
  +          * BLOCKED    notifies from non-listed or blocked IPs will be ignored
  +          * ]]></screen>
  +        '';
  +      };
  +
  +      requestXFR = mkOption {
  +        type        = types.listOf types.str;
  +        default     = [];
  +        example     = [];
  +        description = ''
  +          Format: <code>[AXFR|UDP] &lt;ip-address&gt; &lt;key-name | NOKEY&gt;</code>
  +        '';
  +      };
  +
  +      allowAXFRFallback = mkOption {
  +        type        = types.bool;
  +        default     = true;
  +        description = ''
  +          If NSD as secondary server should be allowed to AXFR if the primary
  +          server does not allow IXFR.
  +        '';
  +      };
  +
  +      notify = mkOption {
  +        type        = types.listOf types.str;
  +        default     = [];
  +        example     = [ "10.0.0.1@3721 my_key" "::5 NOKEY" ];
  +        description = ''
  +          This primary server will notify all given secondary servers about
  +          zone changes.
  +          <screen><![CDATA[
  +          Format: <ip> <key-name | NOKEY>
  +
  +          <ip> a plain IPv4/IPv6 address with on optional port number (ip@port)
  +
  +          <key-name | NOKEY>
  +          * <key-name> sign notifies with the specified key
  +          * NOKEY      don't sign notifies
  +          ]]></screen>
  +        '';
  +      };
  +
  +      notifyRetry = mkOption {
  +        type        = types.int;
  +        default     = 5;
  +        description = ''
  +          Specifies the number of retries for failed notifies. Set this along with notify.
  +        '';
  +      };
  +
  +      provideXFR = mkOption {
  +        type        = types.listOf types.str;
  +        default     = [];
  +        example     = [ "192.0.2.0/24 NOKEY" "192.0.2.0/24 my_tsig_key_name" ];
  +        description = ''
  +          Allow these IPs and TSIG to transfer zones, addr TSIG|NOKEY|BLOCKED
  +          address range 192.0.2.0/24, 1.2.3.4&amp;255.255.0.0, 3.0.2.20-3.0.2.40
  +        '';
  +      };
  +
  +      outgoingInterface = mkOption {
  +        type        = types.nullOr types.str;
  +        default     = null;
  +        example     = "2000::1@1234";
  +        description = ''
  +          This address will be used for zone-transfere requests if configured
  +          as a secondary server or notifications in case of a primary server.
  +          Supply either a plain IPv4 or IPv6 address with an optional port
  +          number (ip@port).
  +        '';
  +      };
  +
  +      rrlWhitelist = mkOption {
  +        type        = types.listOf types.str;
  +        default     = [];
  +        description = ''
  +          Whitelists the given rrl-types.
  +          The RRL classification types are:  nxdomain,  error, referral, any,
  +          rrsig, wildcard, nodata, dnskey, positive, all
  +        '';
  +      };
  +
  +      data = mkOption {
  +        type        = types.str;
  +        default     = "";
  +        example     = "";
  +        description = ''
  +          The actual zone data. This is the content of your zone file.
  +          Use imports or pkgs.lib.readFile if you don't want this data in your config file.
  +        '';
  +      };
  +    };
  +  };
   
   in
   {
  
positive.code: 
        # fork -> pattern
        else zipAttrsWith (name: head) (
            mapAttrsToList (name: child: zoneConfigs' (parent // zone // { children = {}; }) name child)
                           zone.children
        );
  
    # fighting infinite recursion
  
negative.code:   pidFile  = stateDir + "/var/nsd.pid";
  
    zoneFiles = pkgs.stdenv.mkDerivation {
      preferLocalBuild = true;
      name = "nsd-env";
      buildCommand = concatStringsSep "\n"
        [ "mkdir -p $out"
          (concatStrings (mapAttrsToList (zoneName: zoneOptions: ''
            cat > "$out/${zoneName}" <<_EOF_
            ${zoneOptions.data}
            _EOF_
          '') zoneConfigs))
        ];
    };
  
    configFile = pkgs.writeText "nsd.conf" ''
  