anchor.diff:        after = [ "network-online.target" ];
         wants = [ "network-online.target" ]; # systemd-networkd-wait-online.service
         wantedBy = [ "multi-user.target" ];
  -      environment = mkIf (versionAtLeast config.system.stateVersion "17.09")
  +      environment = mkIf (versionAtLeast config.system.stateVersion "17.09" && !isCaddy2)
           { CADDYPATH = cfg.dataDir; };
         serviceConfig = {
  -        ExecStart = ''
  +        ExecStart = if isCaddy2 then ''
  +          ${cfg.package}/bin/caddy run --config ${configJSON}
  +        '' else ''
             ${cfg.package}/bin/caddy -log stdout -log-timestamps=false \
               -root=/var/tmp -conf=${configFile} \
               -ca=${cfg.ca} -email=${cfg.email} ${optionalString cfg.agree "-agree"}
  
positive.code:       '';
        type = types.lines;
        description = "Verbatim Caddyfile to use";
      };
  
      ca = mkOption {
  
negative.code: let
    cfg = config.services.caddy;
    configFile = pkgs.writeText "Caddyfile" cfg.config;
  
    # v2-specific options
    isCaddy2 = versionAtLeast cfg.package.version "2.0";
    tlsConfig = {
      apps.tls.automation.policies = [{
        issuer = {
          inherit (cfg) ca email;
          module = "acme";
        };
      }];
    };
    adaptedConfig = importJSON (pkgs.runCommand "caddy-config-adapted.json" { } ''
      ${cfg.package}/bin/caddy adapt \
        --config ${configFile} --adapter ${cfg.adapter} > $out
    '');
    configJSON = pkgs.writeText "caddy-config.json" (builtins.toJSON
      (recursiveUpdate adaptedConfig tlsConfig));
  in {
    options.services.caddy = {
      enable = mkEnableOption "Caddy web server";
  
      config = mkOption {
        default = "";
        # TODO: update example text on v2.0 release
        example = ''
          example.com {
          gzip
  