anchor.diff:      '';
     };
   
  -  # Previously, all certs were owned by whatever user was configured in
  -  # config.security.acme.certs.<cert>.user. Now everything is owned by and
  -  # run by the acme user.
  +  # Ensures that directories which are shared across all certs
  +  # exist and have the correct user and group, since group
  +  # is configurable on a per-cert basis.
     userMigrationService = {
       description = "Fix owner and group of all ACME certificates";
   
  
positive.code:       serviceConfig = commonServiceConfig // {
          Group = data.group;
  
          # AccountDir dir will be created by tmpfiles to ensure correct permissions
          # And to avoid deletion during systemctl clean
          # acme/.lego/${cert} is listed so that it is deleted during systemctl clean
          StateDirectory = "acme/${cert} acme/.lego/${cert} acme/.lego/${cert}/${certDir}";
  
          # Needs to be space separated, but can't use a multiline string because that'll include newlines
          BindPaths =
  
negative.code:     );
  
    in {
      inherit accountHash cert selfsignedDeps;
  
      webroot = data.webroot;
      group = data.group;
  