anchor.diff:        allowKeysForGroup = mkOption {
           type = types.bool;
           default = false;
  -        description = "Give read permissions to the specified group to read SSL private certificates.";
  +        description = ''
  +          Give read permissions to the specified group
  +          (<option>security.acme.group</option>) to read SSL private certificates.
  +        '';
         };
   
         postRun = mkOption {
  
positive.code:         description = ''
            Where the webroot of the HTTP vhost is located.
            <filename>.well-known/acme-challenge/</filename> directory
            will be created automatically if it doesn't exist.
            <literal>http://example.org/.well-known/acme-challenge/</literal> must also
            be available (notice unencrypted HTTP).
          '';
  
negative.code:       extraDomains = mkOption {
          type = types.attrsOf (types.nullOr types.str);
          default = {};
          example = literalExample ''
            {
              "example.org" = "/srv/http/nginx";
              "mydomain.org" = null;
            }
          '';
          description = ''
            Extra domain names for which certificates are to be issued, with their
            own server roots if needed.
  