anchor.diff:  in
   
   {
  -  ##### interface
  -
     options = {
  -
       services.dnscrypt-proxy = {
  -
         enable = mkOption {
           default = false;
           type = types.bool;
           description = ''
  -          Enable dnscrypt-proxy.
  -          The proxy relays regular DNS queries to a DNSCrypt enabled
  -          upstream resolver.
  -          The traffic between the client and the upstream resolver is
  -          encrypted and authenticated, which may mitigate the risk of MITM
  -          attacks and third-party snooping (assuming the upstream is
  -          trustworthy).
  +          Enable dnscrypt-proxy. The proxy relays regular DNS queries to a
  +          DNSCrypt enabled upstream resolver. The traffic between the
  +          client and the upstream resolver is encrypted and authenticated,
  +          which may mitigate the risk of MITM attacks and third-party
  +          snooping (assuming the upstream is trustworthy).
           '';
         };
  -
         localAddress = mkOption {
           default = "127.0.0.1";
           type = types.string;
  
positive.code:           Listen on this port.
          '';
        };
  
        resolverName = mkOption {
          default = "opendns";
          type = types.string;
  
negative.code:     };
      users.extraGroups.dnscrypt-proxy.gid = config.ids.gids.dnscrypt-proxy;
  
      systemd.sockets.dnscrypt-proxy = {
        description = "dnscrypt-proxy listening socket";
        socketConfig = {
          ListenStream = "${cfg.localAddress}:${toString cfg.port}";
          ListenDatagram = "${cfg.localAddress}:${toString cfg.port}";
        };
        wantedBy = [ "sockets.target" ];
      };
  
      systemd.services.dnscrypt-proxy = {
        description = "dnscrypt-proxy daemon";
        after = [ "network.target" ] ++ optional apparmorEnabled "apparmor.service";
        requires = [ "dnscrypt-proxy.socket "] ++ optional apparmorEnabled "apparmor.service";
        serviceConfig = {
          Type = "simple";
          NonBlocking = "true";
          ExecStart = "${dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
          User = "dnscrypt-proxy";
  