anchor.diff:        done
       '') certConfigs);
   
  -    # We don't want this to run every time a renewal happens
  -    serviceConfig.RemainAfterExit = true;
  +    serviceConfig = {
  +      # We don't want this to run every time a renewal happens
  +      RemainAfterExit = true;
  +
  +      # These StateDirectory entries negate the need for tmpfiles
  +      StateDirectory = "acme acme/.lego acme/.lego/accounts";
  +    };
     };
   
     certToConfig = cert: data: let
  
positive.code:     '';
    };
  
    # Previously, all certs were owned by whatever user was configured in
    # config.security.acme.certs.<cert>.user. Now everything is owned by and
    # run by the acme user.
    userMigrationService = {
      description = "Fix owner and group of all ACME certificates";
  
  
negative.code:       serviceConfig = commonServiceConfig // {
          Group = data.group;
  
          # Keep in mind that these directories will be deleted if the user runs
          # systemctl clean --what=state
          # acme/.lego/${cert} is listed for this reason.
          StateDirectory =
            "acme/${cert} " +
            "acme/.lego/${cert} " +
            "acme/.lego/${cert}/${certDir} " +
            "acme/.lego/accounts/${accountHash} ";
  
          # Needs to be space separated, but can't use a multiline string because that'll include newlines
          BindPaths =
  