anchor.diff:        done
       '') certConfigs);
   
  -    # We don't want this to run every time a renewal happens
  -    serviceConfig.RemainAfterExit = true;
  +    serviceConfig = {
  +      # We don't want this to run every time a renewal happens
  +      RemainAfterExit = true;
  +
  +      # These StateDirectory entries negate the need for tmpfiles
  +      StateDirectory = "acme acme/.lego acme/.lego/accounts";
  +    };
     };
   
     certToConfig = cert: data: let
  
positive.code: 
        systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;
  
        # .lego and .lego/accounts specified to fix any incorrect permissions
        systemd.tmpfiles.rules = [
          "d /var/lib/acme/.lego - acme acme"
          "d /var/lib/acme/.lego/accounts - acme acme"
        ] ++ (unique (concatMap (conf: [
            "d ${conf.accountDir} - acme acme"
          ] ++ (optionals (conf.webroot != null) [
            "d ${conf.webroot} - acme ${conf.group}"
            "d ${conf.webroot}/.well-known - acme ${conf.group}"
            "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}"
          ])
        ) (attrValues certConfigs)));
  
        systemd.targets = let
          # Create some targets which can be depended on to be "active" after cert renewals
  
negative.code:     );
  
    in {
      inherit accountHash cert selfsignedDeps;
  
      webroot = data.webroot;
      group = data.group;
  