anchor.diff:            enable = true;
             virtualHosts = lib.mkMerge (map (host: {
               ${host} = {
  -              sslCertificate = "/tmp/${host}-cert.pem";
  -              sslCertificateKey = "/tmp/${host}-key.pem";
  +              sslCertificate = "/var/ssl/${host}-cert.pem";
  +              sslCertificateKey = "/var/ssl/${host}-key.pem";
                 extraConfig = ''
                   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                 '';
  
positive.code:     certificate = {
        group = "nginx";
        owner = "nginx";
        path = "/tmp/${host}-cert.pem";
      };
      private_key = {
        group = "nginx";
        mode = "0600";
        owner = "nginx";
        path = "/tmp/${host}-key.pem";
      };
      request = {
        CN = host;
  
negative.code:       file = {
          group = "nginx";
          owner = "nginx";
          path = "/var/ssl/${host}-ca.pem";
        };
        label = "www_ca";
        profile = "three-month";
  