anchor.diff:          description = ''
             Where the webroot of the HTTP vhost is located.
             <filename>.well-known/acme-challenge/</filename> directory
  -          will be created automatically if it doesn't exist.
  +          will be created below the webroot if it doesn't exist.
             <literal>http://example.org/.well-known/acme-challenge/</literal> must also
             be available (notice unencrypted HTTP).
           '';
  
positive.code:         description = ''
            Attribute set of certificates to get signed and renewed.
          '';
          example = {
            "example.com" = {
              webroot = "/var/www/challenges/";
              email = "foo@example.com";
              extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
            };
            "bar.example.com" = {
              webroot = "/var/www/challenges/";
              email = "bar@example.com";
            };
          };
        };
      };
    };
  
negative.code:       allowKeysForGroup = mkOption {
          type = types.bool;
          default = false;
          description = ''
            Give read permissions to the specified group
            (<option>security.acme.group</option>) to read SSL private certificates.
          '';
        };
  
        postRun = mkOption {
  