anchor.diff:            preStart = ''
               mkdir -p '${cfg.directory}'
               if [ ! -d '${cpath}' ]; then
  -              mkdir -m 700 '${cpath}'
  -              chown '${data.user}:${data.group}' '${cpath}'
  +              mkdir '${cpath}'
               fi
  +            chmod ${rights} '${cpath}'
  +            chown -R '${data.user}:${data.group}' '${cpath}'
             '';
             script = ''
               cd '${cpath}'
  
positive.code:       systemd.services = flip mapAttrs' cfg.certs (cert: data:
          let
            cpath = "${cfg.directory}/${cert}";
            cmdline = [ "-v" "-d" cert "--default_root" data.webroot "--valid_min" cfg.validMin ]
                      ++ optionals (data.email != null) [ "--email" data.email ]
                      ++ concatMap (p: [ "-f" p ]) data.plugins
  
negative.code:         type = types.str;
          default = "root";
          description = "Group running the ACME client.";
        };
  
        allowKeysForGroup = mkOption {
          type = types.bool;
          default = false;
          description = "Give read permissions to the specified group to read SSL private certificates.";
        };
  
        postRun = mkOption {
  