anchor.diff:  
         systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;
   
  -      # .lego and .lego/accounts specified to fix any incorrect permissions
  -      systemd.tmpfiles.rules = [
  -        "d /var/lib/acme/.lego - acme acme"
  -        "d /var/lib/acme/.lego/accounts - acme acme"
  -      ] ++ (unique (concatMap (conf: [
  -          "d ${conf.accountDir} - acme acme"
  -        ] ++ (optionals (conf.webroot != null) [
  -          "d ${conf.webroot} - acme ${conf.group}"
  -          "d ${conf.webroot}/.well-known - acme ${conf.group}"
  -          "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}"
  -        ])
  -      ) (attrValues certConfigs)));
  +      systemd.tmpfiles.rules = unique (
  +        flatten (
  +          mapAttrsToList (
  +            cert: conf:
  +              optional (conf.webroot != null) "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}"
  +          ) certConfigs
  +        )
  +      );
   
         systemd.targets = let
           # Create some targets which can be depended on to be "active" after cert renewals
  
positive.code:     );
  
    in {
      inherit accountHash accountDir cert selfsignedDeps;
  
      webroot = data.webroot;
      group = data.group;
  
negative.code:       done
      '') certConfigs);
  
      serviceConfig = {
        # We don't want this to run every time a renewal happens
        RemainAfterExit = true;
  
        # These StateDirectory entries negate the need for tmpfiles
        StateDirectory = "acme acme/.lego acme/.lego/accounts";
      };
    };
  
    certToConfig = cert: data: let
  