anchor.diff:          default = "dnscrypt.eu-nl";
           type = types.nullOr types.string;
           description = ''
  -          The name of the upstream DNSCrypt resolver to use. See
  -          <filename>${resolverListFile}</filename> for alternative resolvers.
  +          The name of the upstream DNSCrypt resolver to use, taken from the
  +          list named in the <literal>resolverList</literal> option.
             The default resolver is located in Holland, supports DNS security
             extensions, and claims to not keep logs.
           '';
  +      };
  +      resolverList = mkOption {
  +        description = ''
  +          The list of upstream DNSCrypt resolvers. By default, we use the most
  +          recent list published by upstream.
  +        '';
  +        example = literalExample "${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv";
  +        default = pkgs.fetchurl {
  +          url = "https://raw.githubusercontent.com/jedisct1/dnscrypt-proxy/master/dnscrypt-resolvers.csv";
  +          sha256 = "07kbbisrvrqdxif3061hxj3whin3llg4nh50ln7prisi2vbd76xd";
  +        };
  +        defaultText = "pkgs.fetchurl { url = ...; sha256 = ...; }";
         };
         customResolver = mkOption {
           default = null;
  
positive.code:         "--provider-key=${cfg.customResolver.key}"
        ]
      else
        [ "--resolvers-list=${resolverListFile}"
          "--resolver-name=${toString cfg.resolverName}"
        ];
  in
  
negative.code:         ${pkgs.lz4}/lib/liblz4.so.* mr,
          ${pkgs.attr.out}/lib/libattr.so.* mr,
  
          ${cfg.resolverList} r,
        }
      ''));
  
  