anchor.diff:        };
         tls_private_key_path = mkOption {
           type = types.nullOr types.str;
  -        default = "/var/lib/matrix-synapse/homeserver.tls.key";
  -        example = null;
  +        default = null;
  +        example = "/var/lib/matrix-synapse/homeserver.tls.key";
           description = ''
             PEM encoded private key for TLS. Specify null if synapse is not
             speaking TLS directly.
           '';
         };
         tls_dh_params_path = mkOption {
  -        type = types.str;
  -        default = "/var/lib/matrix-synapse/homeserver.tls.dh";
  +        type = types.nullOr types.str;
  +        default = null;
  +        example = "/var/lib/matrix-synapse/homeserver.tls.dh";
           description = ''
             PEM dh parameters for ephemeral keys
           '';
  
positive.code:         Group = "matrix-synapse";
          WorkingDirectory = "/var/lib/matrix-synapse";
          PermissionsStartOnly = true;
          ExecStart = "${cfg.package}/bin/homeserver --config-path ${configFile}";
        };
      };
    };
  
negative.code:         '';
        };
        tls_certificate_path = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "/var/lib/matrix-synapse/homeserver.tls.crt";
          description = ''
            PEM encoded X509 certificate for TLS.
            You can replace the self-signed certificate that synapse
  