anchor.diff:          description = "Contact email address for the CA to be able to reach you.";
         };
   
  +      user = mkOption {
  +        type = types.str;
  +        default = "root";
  +        description = "User under which simp_le would run.";
  +      };
  +
  +      group = mkOption {
  +        type = types.str;
  +        default = "root";
  +        description = "Group under which simp_le would run.";
  +      };
  +
  +      postRun = mkOption {
  +        type = types.lines;
  +        default = "";
  +        example = "systemctl reload nginx.service";
  +        description = ''
  +          Commands to run after certificates are re-issued. Typically
  +          the web server and other servers using certificates need to
  +          be reloaded.
  +        '';
  +      };
  +
         plugins = mkOption {
           type = types.listOf (types.enum [
             "cert.der" "cert.pem" "chain.der" "chain.pem" "external_pem.sh"
  -          "fullchain.der" "fullchain.pem" "key.der" "key.pem"
  +          "fullchain.der" "fullchain.pem" "key.der" "key.pem" "account_key.json"
           ]);
  -        default = [ "fullchain.pem" "key.pem" ];
  -        description = "Plugins to enable.";
  +        default = [ "fullchain.pem" "key.pem" "account_key.json" ];
  +        description = ''
  +          Plugins to enable. With default settings simp_le will
  +          store public certificate bundle in <filename>fullchain.pem</filename>
  +          and private key in <filename>key.pem</filename> in its state directory.
  +        '';
         };
   
         extraDomains = mkOption {
  -        default = [ ];
  -        type = types.listOf types.str;
  -        description = "More domains to include in the certificate.";
  -        example = [ "example.com" "foo.example.com:/var/www/foo" ];
  +        type = types.attrsOf (types.nullOr types.str);
  +        default = {};
  +        example = {
  +          "example.org" = "/srv/http/nginx";
  +          "mydomain.org" = null;
  +        };
  +        description = ''
  +          Extra domain names for which certificates are to be issued, with their
  +          own server roots if needed.
  +        '';
         };
       };
     };
  
positive.code:         '';
          options = [ certOpts ];
          example = {
            "foo.example.com" = {
              webroot = "/var/www/challenges/";
              email = "foo@example.com";
              extraDomains = [ "www.example.com" "example.com" ];
            };
            "bar.example.com" = {
              webroot = "/var/www/challenges/";
  
negative.code:         default = "/etc/ssl";
          type = types.str;
          description = ''
            Directory where certs and other state will be stored by default.
          '';
        };
  
  