anchor.diff:  with lib;
   
   let
  -  apparmorEnabled = config.security.apparmor.enable;
  -
     cfg = config.services.dnscrypt-proxy;
   
     stateDirectory = "/var/lib/dnscrypt-proxy";
  
positive.code:     };
      }
  
      (mkIf apparmorEnabled {
      security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
        ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
          /dev/null rw,
  
negative.code:       documentation = [ "man:dnscrypt-proxy(8)" ];
  
        before = [ "nss-lookup.target" ];
        after = [ "network.target" ];
        requires = [ "dnscrypt-proxy.socket "];
  
        serviceConfig = {
          NonBlocking = "true";
  