anchor.diff:                            ++ optionals (data.email != null) [ "--email" data.email ]
                             ++ concatMap (p: [ "-f" p ]) data.plugins
                             ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
  -                          ++ optionals (!cfg.production) ["--server" "https://acme-staging-v02.api.letsencrypt.org/directory"];
  +                          ++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)];
                   acmeService = {
                     description = "Renew ACME Certificate for ${cert}";
                     after = [ "network.target" "network-online.target" ];
  
positive.code:         '';
        };
  
        preliminarySelfsigned = mkOption {
          type = types.bool;
          default = true;
  
negative.code:           will be created below the webroot if it doesn't exist.
            <literal>http://example.org/.well-known/acme-challenge/</literal> must also
            be available (notice unencrypted HTTP).
          '';
        };
  
        server = mkOption {
          type = types.nullOr types.str;
          default = null;
          description = ''
            ACME Directory Resource URI. Defaults to let's encrypt
            production endpoint,
            https://acme-v02.api.letsencrypt.org/directory, if unset.
          '';
        };
  
  