anchor.diff:                        chown '${data.user}:${data.group}' '${cpath}/key.pem'
                         chmod ${rights} '${cpath}/fullchain.pem'
                         chown '${data.user}:${data.group}' '${cpath}/fullchain.pem'
  +                      chmod ${rights} '${cpath}/full.pem'
  +                      chown '${data.user}:${data.group}' '${cpath}/full.pem'
                       '';
                     serviceConfig = {
                       Type = "oneshot";
  
positive.code:           "cert.der" "cert.pem" "chain.pem" "external.sh"
            "fullchain.pem" "full.pem" "key.der" "key.pem" "account_key.json"
          ]);
          default = [ "fullchain.pem" "key.pem" "account_key.json" ];
          description = ''
            Plugins to enable. With default settings simp_le will
            store public certificate bundle in <filename>fullchain.pem</filename>
            and private key in <filename>key.pem</filename> in its state directory.
          '';
        };
  
  
negative.code:                 )
                );
            servicesAttr = listToAttrs services;
            injectServiceDep = {
              after = [ "acme-selfsigned-certificates.target" ];
              wants = [ "acme-selfsigned-certificates.target" "acme-certificates.target" ];
            };
          in
            servicesAttr //
            (if config.services.nginx.enable then { nginx = injectServiceDep; } else {}) //
            (if config.services.lighttpd.enable then { lighttpd = injectServiceDep; } else {});
  
        systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
          ("acme-${cert}")
  