anchor.diff:      "forward-zone:\n  name: .\n" +
       concatMapStrings (x: "  forward-addr: ${x}\n") cfg.forwardAddresses;
   
  +  rootTrustAnchorFile = "${stateDir}/root.key";
  +
  +  trustAnchor = optionalString cfg.enableRootTrustAnchor
  +    "auto-trust-anchor-file: ${rootTrustAnchorFile}";
  +
     confFile = pkgs.writeText "unbound.conf" ''
       server:
         directory: "${stateDir}"
  
positive.code:       pidfile: ""
        ${interfaces}
        ${access}
      ${cfg.extraConfig}
      ${forward}
    '';
  
negative.code:         description = "What servers to forward queries to.";
        };
  
        enableRootTrustAnchor = mkOption {
          default = true;
          type = types.bool;
          description = "Use and update root trust anchor for DNSSEC validation.";
        };
  
        extraConfig = mkOption {
          default = "";
          type = types.str;
  