anchor.diff:                  lpath = "acme/${cert}";
                   apath = "/var/lib/${lpath}";
                   spath = "/var/lib/acme/.lego";
  -                rights = if data.allowKeysForGroup then "750" else "700";
  +                fileMode = if data.allowKeysForGroup then "640" else "600";
                   globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
                             ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
                             ++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]
  
positive.code:                     Group = data.group;
                      PrivateTmp = true;
                      StateDirectory = "acme/.lego ${lpath}";
                      StateDirectoryMode = rights;
                      WorkingDirectory = spath;
                      # Only try loading the credentialsFile if the dns challenge is enabled
                      EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
  
negative.code: 
                        # Give key acme permissions
                        chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem
                        chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem
                      '';
                    serviceConfig = {
                      Type = "oneshot";
  