anchor.diff:            will be created below the webroot if it doesn't exist.
             <literal>http://example.org/.well-known/acme-challenge/</literal> must also
             be available (notice unencrypted HTTP).
  +        '';
  +      };
  +
  +      server = mkOption {
  +        type = types.nullOr types.str;
  +        default = null;
  +        description = ''
  +          ACME Directory Resource URI. Defaults to let's encrypt
  +          production endpoint,
  +          https://acme-v02.api.letsencrypt.org/directory, if unset.
           '';
         };
   
  
positive.code: {
  
    ###### interface
  
    options = {
      security.acme = {
  
  
negative.code:                           ++ optionals (data.email != null) [ "--email" data.email ]
                            ++ concatMap (p: [ "-f" p ]) data.plugins
                            ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
                            ++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)];
                  acmeService = {
                    description = "Renew ACME Certificate for ${cert}";
                    after = [ "network.target" "network-online.target" ];
  