anchor.diff:            services.nginx.virtualHosts.<name>.useACMEHost are mutually exclusive.
           '';
         }
  -    ];
  -
  -    systemd.tmpfiles.rules = [
  -      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group} - -"
  -      "d '${cfg.stateDir}/logs' 0750 ${cfg.user} ${cfg.group} - -"
  -      "Z '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
       ];
   
       systemd.services.nginx = {
  
positive.code:     };
    };
  
    config = mkIf cfg.enable {
      # TODO: test user supplied config file pases syntax test
  
  
negative.code:         # Runtime directory and mode
          RuntimeDirectory = "nginx";
          RuntimeDirectoryMode = "0750";
          # Cache directory and mode
          CacheDirectory = "nginx";
          CacheDirectoryMode = "0750";
          # Logs directory and mode
          LogsDirectory = "nginx";
          LogsDirectoryMode = "0750";
          # Capabilities
          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" "CAP_SYS_RESOURCE" ];
        };
  