anchor.diff:        let
           ssl = vhost.enableSSL || vhost.forceSSL;
           port = if vhost.port != null then vhost.port else (if ssl then 443 else 80);
  -        listenString = toString port + optionalString ssl " ssl spdy"
  +        listenString = toString port + optionalString ssl " ssl http2"
             + optionalString vhost.default " default";
           acmeLocation = optionalString vhost.enableACME ''
             location /.well-known/acme-challenge {
  
positive.code: 
        sslCiphers = mkOption {
          type = types.str;
          default = "EDH+CHACHA20:EDH+AES:EECDHE+CHACHA20:ECDHE+AES:+AES128:-DSS";
          description = "Ciphers to choose from when negotiating tls handshakes.";
        };
  
  
negative.code:       ssl_session_timeout 23m;
  
        ssl_ciphers ${cfg.sslCiphers};
        ssl_ecdh_curve secp384r1;
        ssl_prefer_server_ciphers on;
        ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
  
  