anchor.diff:            Listen on this port.
           '';
         };
  -
         resolverName = mkOption {
           default = "opendns";
           type = types.string;
  
positive.code:           location).
          '';
        };
  
        tcpOnly = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Force sending encrypted DNS queries to the upstream resolver
            over TCP instead of UDP (on port 443).
            Enabling this option may help circumvent filtering, but should
            not be used otherwise.
          '';
        };
  
      };
  
    };
  
    ##### implementation
  
    config = mkIf cfg.enable {
  
      ### AppArmor profile
  
      security.apparmor.profiles = mkIf apparmorEnabled [
        (pkgs.writeText "apparmor-dnscrypt-proxy" ''
  
          ${dnscrypt-proxy}/bin/dnscrypt-proxy {
  
            /dev/null rw,
            /dev/urandom r,
  
            /etc/passwd r,
            /etc/group r,
            ${config.environment.etc."nsswitch.conf".source} r,
  
            ${pkgs.glibc}/lib/*.so mr,
            ${pkgs.tzdata}/share/zoneinfo/** r,
  
            network inet stream,
            network inet6 stream,
            network inet dgram,
            network inet6 dgram,
  
            ${pkgs.gcc.cc}/lib/libssp.so.* mr,
            ${pkgs.libsodium}/lib/libsodium.so.* mr,
            ${pkgs.systemd}/lib/libsystemd.so.* mr,
            ${pkgs.xz}/lib/liblzma.so.* mr,
            ${pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
            ${pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
  
            ${resolverListFile} r,
          }
        '')
      ];
  
      users.extraUsers.dnscrypt-proxy = {
        uid = config.ids.uids.dnscrypt-proxy;
  
negative.code: in
  
  {
    options = {
      services.dnscrypt-proxy = {
        enable = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Enable dnscrypt-proxy. The proxy relays regular DNS queries to a
            DNSCrypt enabled upstream resolver. The traffic between the
            client and the upstream resolver is encrypted and authenticated,
            which may mitigate the risk of MITM attacks and third-party
            snooping (assuming the upstream is trustworthy).
          '';
        };
        localAddress = mkOption {
          default = "127.0.0.1";
          type = types.string;
  