anchor.diff:        security.acme.server = "https://acme.test/dir";
   
         specialisation.second-cert.configuration = {pkgs, ...}: {
  -        systemd.targets."acme-finished-b.example.test" = {};
  +        systemd.targets."acme-finished-b.example.test" = {
  +          after = [ "acme-b.example.test.service" ];
  +          wantedBy = [ "acme-b.example.test.service" ];
  +        };
           systemd.services."acme-b.example.test" = {
  -          wants = [ "acme-finished-b.example.test.target" ];
  -          before = [ "acme-finished-b.example.test.target" ];
             after = [ "nginx.service" ];
           };
           services.nginx.virtualHosts."b.example.test" = {
  
positive.code: 
        # A target remains active. Use this to probe the fact that
        # a service fired eventhough it is not RemainAfterExit
        systemd.targets."acme-finished-a.example.test" = {};
        systemd.services."acme-a.example.test" = {
          wants = [ "acme-finished-a.example.test.target" ];
          before = [ "acme-finished-a.example.test.target" ];
          after = [ "nginx.service" ];
        };
  
  
negative.code:           user = config.services.nginx.user;
            group = config.services.nginx.group;
          };
          systemd.targets."acme-finished-example.test" = {
            after = [ "acme-example.test.service" ];
            wantedBy = [ "acme-example.test.service" ];
          };
          systemd.services."acme-example.test" = {
            before = [ "nginx.service" ];
            wantedBy = [ "nginx.service" ];
          };
          services.nginx.virtualHosts."c.example.test" = {
  