anchor.diff:        customResolver = mkOption {
           default = null;
           description = ''
  -          Use a resolver not listed in the upstream list (e.g.,
  -          a private DNSCrypt provider). For advanced users only.
  -          If specified, this option takes precedence.
  +          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
  +          advanced users only. If specified, this option takes precedence.
           '';
           type = types.nullOr (types.submodule ({ ... }: { options = {
             address = mkOption {
  
positive.code:             type = types.str;
              description = "Provider fully qualified domain name";
              example = "2.dnscrypt-cert.opendns.com";
           };
           key = mkOption {
             type = types.str;
             description = "Provider public key";
             example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
           }; }; }));
        };
        tcpOnly = mkOption {
          default = false;
          type = types.bool;
          description = ''
            Force sending encrypted DNS queries to the upstream resolver
            over TCP instead of UDP (on port 443). Enabling this option may
            help circumvent filtering, but should not be used otherwise.
          '';
        };
      };
  
negative.code:         type = types.nullOr types.string;
          description = ''
            The name of the upstream DNSCrypt resolver to use. See
            <filename>${resolverListFile}</filename> for alternative resolvers
            (e.g., if you are concerned about logging and/or server
            location).
          '';
  