anchor.diff:          default = "_mkMergedOptionModule";
         };
   
  +      enableDebugLogs = mkEnableOption "debug logging for this certificate" // { default = cfg.enableDebugLogs; };
  +
         webroot = mkOption {
           type = types.nullOr types.str;
           default = null;
  
positive.code: 
    options = {
      security.acme = {
  
        validMinDays = mkOption {
          type = types.int;
  
negative.code: 
        # Working directory will be /tmp
        script = ''
          ${optionalString data.enableDebugLogs "set -x"}
          set -euo pipefail
  
          # This reimplements the expiration date check, but without querying
          # the acme server first. By doing this offline, we avoid errors
  