anchor.diff:    in {
       inherit accountHash cert selfsignedDeps;
   
  -    webroot = data.webroot;
       group = data.group;
   
       renewTimer = {
  
positive.code:             ${data.postRun}
            fi
          '');
        };
  
        # Working directory will be /tmp
        script = ''
  
negative.code:   # Ensures that directories which are shared across all certs
    # exist and have the correct user and group, since group
    # is configurable on a per-cert basis.
    userMigrationService = let
      script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: ''
        chown -R acme .lego/accounts
        for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do
          if [ -d "$fixpath" ]; then
            chmod -R u=rwX,g=rX,o= "$fixpath"
            chown -R acme:${data.group} "$fixpath"
          fi
        done
      '') certConfigs);
    in {
      description = "Fix owner and group of all ACME certificates";
  
      serviceConfig = commonServiceConfig // {
        # We don't want this to run every time a renewal happens
        RemainAfterExit = true;
  
        # These StateDirectory entries negate the need for tmpfiles
        StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];
        StateDirectoryMode = 755;
        WorkingDirectory = "/var/lib/acme";
  
        # Run the start script as root
        ExecStart = "+" + (pkgs.writeShellScript "acme-fixperms" script);
      };
    };
  
  