anchor.diff:                  };
                 in (
                   [ { name = "acme-${cert}"; value = acmeService; } ]
  -                ++
  -                (if cfg.preliminarySelfsigned
  -                  then [ { name = "acme-selfsigned-${cert}"; value = selfsignedService; } ]
  -                  else []
  -                )
  +                ++ optional cfg.preliminarySelfsigned { name = "acme-selfsigned-${cert}"; value = selfsignedService; }
  +                ++ optional (data.activationDelay != null) { name = "acme-setlive-${cert}"; value = delayService; }
                 );
             servicesAttr = listToAttrs services;
             injectServiceDep = {
  
positive.code:                     Group = data.group;
                      PrivateTmp = true;
                    };
                    path = [ pkgs.simp_le ];
                    preStart = ''
                      mkdir -p '${cfg.directory}'
                      chown 'root:root' '${cfg.directory}'
  
negative.code:           store public certificate bundle in <filename>fullchain.pem</filename>,
            private key in <filename>key.pem</filename> and those two previous
            files combined in <filename>full.pem</filename> in its state directory.
          '';
        };
  
        activationDelay = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = ''
            Systemd time span expression to delay copying new certificates to main
            state directory. See <citerefentry><refentrytitle>systemd.time</refentrytitle>
            <manvolnum>7</manvolnum></citerefentry>.
          '';
        };
  
        preDelay = mkOption {
          type = types.lines;
          default = "";
          description = ''
            Commands to run after certificates are re-issued but before they are
            activated. Typically the new certificate is published to DNS.
  
            Executed in the same directory with the new certificate.
          '';
        };
  
  