anchor.diff:            store public certificate bundle in <filename>fullchain.pem</filename>,
             private key in <filename>key.pem</filename> and those two previous
             files combined in <filename>full.pem</filename> in its state directory.
  +        '';
  +      };
  +
  +      activationDelay = mkOption {
  +        type = types.nullOr types.str;
  +        default = null;
  +        description = ''
  +          Systemd time span expression to delay copying new certificates to main
  +          state directory. See <citerefentry><refentrytitle>systemd.time</refentrytitle>
  +          <manvolnum>7</manvolnum></citerefentry>.
  +        '';
  +      };
  +
  +      preDelay = mkOption {
  +        type = types.lines;
  +        default = "";
  +        description = ''
  +          Commands to run after certificates are re-issued but before they are
  +          activated. Typically the new certificate is published to DNS.
  +
  +          Executed in the same directory with the new certificate.
           '';
         };
   
  
positive.code:           certToServices = cert: data:
                let
                  domain = if data.domain != null then data.domain else cert;
                  cpath = "${cfg.directory}/${cert}";
                  rights = if data.allowKeysForGroup then "750" else "700";
                  cmdline = [ "-v" "-d" domain "--default_root" data.webroot "--valid_min" cfg.validMin ]
                            ++ optionals (data.email != null) [ "--email" data.email ]
                            ++ concatMap (p: [ "-f" p ]) data.plugins
                            ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
                            ++ (if cfg.production then []
                                else ["--server" "https://acme-staging.api.letsencrypt.org/directory"]);
                  acmeService = {
                    description = "Renew ACME Certificate for ${cert}";
                    after = [ "network.target" "network-online.target" ];
  
negative.code:                     Group = data.group;
                      PrivateTmp = true;
                    };
                    path = with pkgs; [ simp_le systemd ];
                    preStart = ''
                      mkdir -p '${cfg.directory}'
                      chown 'root:root' '${cfg.directory}'
  