anchor.diff:        socketConfig.FreeBind = true;
       };
   
  +    systemd.sockets.kresd-tls = mkIf (cfg.listenTLS != []) rec {
  +      wantedBy = [ "sockets.target" ];
  +      before = wantedBy;
  +      partOf = [ "kresd.socket" ];
  +      listenStreams = cfg.listenTLS;
  +      socketConfig = {
  +        FileDescriptorName = "tls";
  +        FreeBind = true;
  +        Service = "kresd.service";
  +      };
  +    };
  +
       systemd.sockets.kresd-control = rec {
         wantedBy = [ "sockets.target" ];
         before = wantedBy;
  
positive.code:         What addresses the server should listen on. (UDP+TCP 53)
        '';
      };
      # TODO: perhaps options for more common stuff like cache size or forwarding
    };
  
  
negative.code:         Type = "notify";
          WorkingDirectory = cfg.cacheDir;
          Restart = "on-failure";
          Sockets = [ "kresd.socket" "kresd-control.socket" ]
            ++ optional (cfg.listenTLS != []) "kresd-tls.socket";
        };
  
        # Trust anchor goes from dns-root-data by default.
  