anchor.diff:                      Group = data.group;
                       PrivateTmp = true;
                       StateDirectory = "acme/.lego ${lpath}";
  -                    StateDirectoryMode = rights;
  +                    StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
                       WorkingDirectory = spath;
                       # Only try loading the credentialsFile if the dns challenge is enabled
                       EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
  
positive.code:                 lpath = "acme/${cert}";
                  apath = "/var/lib/${lpath}";
                  spath = "/var/lib/acme/.lego";
                  rights = if data.allowKeysForGroup then "750" else "700";
                  globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
                            ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
                            ++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]
  
negative.code: 
                        # Give key acme permissions
                        chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem
                        chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem
                      '';
                    serviceConfig = {
                      Type = "oneshot";
  