anchor.diff:          type = types.str;
           default = "root";
           description = "Group running the ACME client.";
  +      };
  +
  +      allowKeysForGroup = mkOption {
  +        type = types.bool;
  +        default = false;
  +        description = "Give read permissions to the specified group to read SSL private certificates.";
         };
   
         postRun = mkOption {
  
positive.code:           preStart = ''
              mkdir -p '${cfg.directory}'
              if [ ! -d '${cpath}' ]; then
                mkdir -m 700 '${cpath}'
                chown '${data.user}:${data.group}' '${cpath}'
              fi
            '';
            script = ''
              cd '${cpath}'
  
negative.code:       systemd.services = flip mapAttrs' cfg.certs (cert: data:
          let
            cpath = "${cfg.directory}/${cert}";
            rights = if cfg.allowKeysForGroup then "750" else "700";
            cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
                      ++ optionals (data.email != null) [ "--email" data.email ]
                      ++ concatMap (p: [ "-f" p ]) data.plugins
  