anchor.diff:        }
       '';
   
  -  dhcpdService = postfix: cfg:
  -    let
  -      configFile =
  -        if cfg.configFile != null
  -          then cfg.configFile
  -          else writeConfig cfg;
  -      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
  -      args = [
  -        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
  -        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
  -        "-cf" configFile
  -        "-lf" leaseFile
  -      ] ++ cfg.extraFlags
  -        ++ cfg.interfaces;
  -    in
  -      optionalAttrs cfg.enable {
  -        "dhcpd${postfix}" = {
  -          description = "DHCPv${postfix} server";
  -          wantedBy = [ "multi-user.target" ];
  -          after = [ "network.target" ];
  -
  -          preStart = "touch ${leaseFile}";
  -          serviceConfig = {
  -            ExecStart = concatMapStringsSep " " escapeShellArg args;
  -            Type = "forking";
  -            Restart = "always";
  -            DynamicUser = true;
  -            User = "dhcpd";
  -            Group = "dhcpd";
  -            AmbientCapabilities = [
  -              "CAP_NET_RAW"          # to send ICMP messages
  -              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
  -            ];
  -            StateDirectory   = "dhcpd${postfix}";
  -            RuntimeDirectory = "dhcpd${postfix}";
  -            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
  -          };
  +  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
  +    "dhcpd${postfix}" = {
  +      description = "DHCPv${postfix} server";
  +      wantedBy = [ "multi-user.target" ];
  +      after = [ "network.target" ];
  +
  +      preStart = ''
  +        mkdir -m 755 -p ${cfg.stateDir}
  +        chown dhcpd:nogroup ${cfg.stateDir}
  +        touch ${cfg.stateDir}/dhcpd.leases
  +      '';
  +
  +      serviceConfig =
  +        let
  +          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
  +          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
  +                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
  +                   "-cf" "${configFile}"
  +                   "-lf" "${cfg.stateDir}/dhcpd.leases"
  +                   "-user" "dhcpd" "-group" "nogroup"
  +                 ] ++ cfg.extraFlags
  +                   ++ cfg.interfaces;
  +
  +        in {
  +          ExecStart = concatMapStringsSep " " escapeShellArg args;
  +          Type = "forking";
  +          Restart = "always";
  +          RuntimeDirectory = [ "dhcpd${postfix}" ];
  +          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
           };
  -      };
  +    };
  +  };
   
     machineOpts = { ... }: {
   
  
positive.code: 
    config = mkIf (cfg4.enable || cfg6.enable) {
  
      systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;
  
    };
  
negative.code:       default = false;
        description = ''
          Whether to enable the DHCPv${postfix} server.
        '';
      };
  
      stateDir = mkOption {
        type = types.path;
        # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
        default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
        description = ''
          State directory for the DHCP server.
        '';
      };
  
  