anchor.diff:  
                         # Give key acme permissions
                         chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem
  -                      chmod ${rights} "${apath}/"{key,fullchain,full}.pem
  +                      chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem
                       '';
                     serviceConfig = {
                       Type = "oneshot";
  
positive.code:                 lpath = "acme/${cert}";
                  apath = "/var/lib/${lpath}";
                  spath = "/var/lib/acme/.lego";
                  rights = if data.allowKeysForGroup then "750" else "700";
                  globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
                            ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
                            ++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]
  
negative.code:                     Group = data.group;
                      PrivateTmp = true;
                      StateDirectory = "acme/.lego ${lpath}";
                      StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
                      WorkingDirectory = spath;
                      # Only try loading the credentialsFile if the dns challenge is enabled
                      EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
  