anchor.diff:    in {
       inherit accountHash cert selfsignedDeps;
   
  -    webroot = data.webroot;
       group = data.group;
   
       renewTimer = {
  
positive.code: 
          StateDirectory = "acme/${cert}";
  
          BindPaths = "/var/lib/acme/.minica:/tmp/ca /var/lib/acme/${cert}:/tmp/${keyName}";
        };
  
        # Working directory will be /tmp
  
negative.code:         # Keep in mind that these directories will be deleted if the user runs
          # systemctl clean --what=state
          # acme/.lego/${cert} is listed for this reason.
          StateDirectory = [
            "acme/${cert}"
            "acme/.lego/${cert}"
            "acme/.lego/${cert}/${certDir}"
            "acme/.lego/accounts/${accountHash}"
          ];
  
          # Needs to be space separated, but can't use a multiline string because that'll include newlines
          BindPaths = [
            "${accountDir}:/tmp/accounts"
            "/var/lib/acme/${cert}:/tmp/out"
            "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates"
          ];
  
          # Only try loading the credentialsFile if the dns challenge is enabled
          EnvironmentFile = mkIf useDns data.credentialsFile;
  