anchor.diff:    certOpts = { name, ... }: {
       options = {
         webroot = mkOption {
  -        type = types.str;
  +        type = types.nullOr types.str;
  +        default = null;
           example = "/var/lib/acme/acme-challenges";
           description = ''
             Where the webroot of the HTTP vhost is located.
  
positive.code: 
        dnsProvider = mkOption {
          type = types.nullOr types.str;
          example = "route53";
          default = null;
          description = "DNS Challenge provider";
        };
  
  
negative.code:           servicesAttr;
  
        systemd.tmpfiles.rules =
          map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));
  
        systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
          ("acme-${cert}")
  