anchor.diff:        }) (filter (hostOpts: hostOpts.useACMEHost == null) acmeEnabledVhosts);
       in listToAttrs acmePairs;
   
  +    # httpd requires a stable path to the configuration file for reloads
  +    environment.etc."httpd/httpd.conf".source = cfg.configFile;
       environment.systemPackages = [
         apachectl
         pkg
  
positive.code:         wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) dependentCertNames);
          after = [ "network.target" ] ++ map (certName: "acme-selfsigned-${certName}.service") dependentCertNames;
          before = map (certName: "acme-${certName}.service") dependentCertNames;
  
          path = [ pkg pkgs.coreutils pkgs.gnugrep ];
  
  
negative.code:       # certs are updated _after_ config has been reloaded.
        before = sslTargets;
        after = sslServices;
        restartTriggers = [ cfg.configFile ];
        # Block reloading if not all certs exist yet.
        # Happens when config changes add new vhosts/certs.
        unitConfig.ConditionPathExists = map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames;
  