anchor.diff:          '';
         };
   
  +      validMin = mkOption {
  +        type = types.int;
  +        default = 30 * 24 * 3600;
  +        description = "Minimum remaining validity before renewal in seconds.";
  +      };
  +
  +      renewInterval = mkOption {
  +        type = types.str;
  +        default = "weekly";
  +        description = ''
  +          Systemd calendar expression when to check for renewal. See
  +          <citerefentry><refentrytitle>systemd.time</refentrytitle>
  +          <manvolnum>5</manvolnum></citerefentry>.
  +        '';
  +      };
  +
         certs = mkOption {
           default = { };
           type = types.loaOf types.optionSet;
  
positive.code:         description = "timer for ACME cert renewal of ${cert}";
          wantedBy = [ "timers.target" ];
          timerConfig = {
            OnCalendar = data.renewInterval;
            Unit = "acme-simp_le-${cert}.service";
          };
        })
  
negative.code:           will be created automatically if it doesn't exist.
            <literal>http://example.org/.well-known/acme-challenge/</literal> must also
            be available (notice unencrypted HTTP).
          '';
        };
  
  