anchor.diff:          default = "/etc/ssl";
           type = types.str;
           description = ''
  -          Directory where certs will be stored by default.
  +          Directory where certs and other state will be stored by default.
           '';
         };
   
  
positive.code:   ###### implementation
    config = mkIf (cfg.certs != { }) {
  
      systemd.services = flip mapAttrs' cfg.certs (cert: data: nameValuePair
        ("simp_le-${cert}")
        ({
          description = "simp_le cert renewal for ${cert}";
          after = [ "network.target" ];
          serviceConfig = {
            Type = "oneshot";
            SuccessExitStatus = "0 1";
          };
          preStart = ''
            mkdir -p "${cfg.directory}/${cert}"
          '';
          script = ''
            WEBROOT="${optionalString (data.webroot == null) data.webroot}"
            cd "${cfg.directory}/${cert}"
            ${pkgs.simp_le}/bin/simp_le -v \
              ${concatMapStringsSep " " (p: "-f ${p}") data.plugins} \
              -d ${cert} --default_root "$WEBROOT" \
              ${concatMapStringsSep " " (p: "-d ${p}") data.extraDomains} \
              ${optionalString (data.email != null) "--email ${data.email}"} \
              --valid_min ${toString data.validMin}
          '';
        })
      );
  
negative.code:         '';
          options = [ certOpts ];
          example = {
            "example.com" = {
              webroot = "/var/www/challenges/";
              email = "foo@example.com";
              extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
            };
            "bar.example.com" = {
              webroot = "/var/www/challenges/";
  