anchor.diff:            will be created automatically if it doesn't exist.
             <literal>http://example.org/.well-known/acme-challenge/</literal> must also
             be available (notice unencrypted HTTP).
  -        '';
  -      };
  -
  -      validMin = mkOption {
  -        type = types.int;
  -        default = 30 * 24 * 3600;
  -        description = "Minimum remaining validity before renewal in seconds.";
  -      };
  -
  -      renewInterval = mkOption {
  -        type = types.str;
  -        default = "weekly";
  -        description = ''
  -          Systemd calendar expression when to check for renewal. See
  -          <citerefentry><refentrytitle>systemd.time</refentrytitle>
  -          <manvolnum>5</manvolnum></citerefentry>.
           '';
         };
   
  
positive.code:         '';
        };
  
        certs = mkOption {
          default = { };
          type = types.loaOf types.optionSet;
  
negative.code:     systemd.services = flip mapAttrs' cfg.certs (cert: data:
        let
          cpath = "${cfg.directory}/${cert}";
          cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
                    ++ optionals (data.email != null) [ "--email" data.email ]
                    ++ concatMap (p: [ "-f" p ]) data.plugins
                    ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains);
  