anchor.diff:        systemd.services = flip mapAttrs' cfg.certs (cert: data:
           let
             cpath = "${cfg.directory}/${cert}";
  +          rights = if cfg.allowKeysForGroup then "750" else "700";
             cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
                       ++ optionals (data.email != null) [ "--email" data.email ]
                       ++ concatMap (p: [ "-f" p ]) data.plugins
  
positive.code:         type = types.str;
          default = "root";
          description = "Group running the ACME client.";
        };
  
        postRun = mkOption {
  
negative.code:           preStart = ''
              mkdir -p '${cfg.directory}'
              if [ ! -d '${cpath}' ]; then
                mkdir '${cpath}'
              fi
              chmod ${rights} '${cpath}'
              chown -R '${data.user}:${data.group}' '${cpath}'
            '';
            script = ''
              cd '${cpath}'
  