anchor.diff:        wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
   
  -      serviceConfig = {
  -        WorkingDirectory = cfg.dataDir;
  -        StateDirectory = cfg.dataDir;
  -        StateDirectoryMode = 700;
  -        Restart = "always";
  -        User = "cfssl";
  -
  -        ExecStart = with cfg; let
  -          opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
  -        in
  -          lib.concatStringsSep " \\\n" [
  -            "${pkgs.cfssl}/bin/cfssl serve"
  -            (opt "address" address)
  -            (opt "port" (toString port))
  -            (opt "ca" ca)
  -            (opt "ca-key" caKey)
  -            (opt "ca-bundle" caBundle)
  -            (opt "int-bundle" intBundle)
  -            (opt "int-dir" intDir)
  -            (opt "metadata" metadata)
  -            (opt "remote" remote)
  -            (opt "config" configFile)
  -            (opt "responder" responder)
  -            (opt "responder-key" responderKey)
  -            (opt "tls-key" tlsKey)
  -            (opt "tls-cert" tlsCert)
  -            (opt "mutual-tls-ca" mutualTlsCa)
  -            (opt "mutual-tls-cn" mutualTlsCn)
  -            (opt "mutual-tls-client-key" mutualTlsClientKey)
  -            (opt "mutual-tls-client-cert" mutualTlsClientCert)
  -            (opt "tls-remote-ca" tlsRemoteCa)
  -            (opt "db-config" dbConfig)
  -            (opt "loglevel" (toString logLevel))
  -          ];
  -      };
  +      serviceConfig = lib.mkMerge [
  +        {
  +          WorkingDirectory = cfg.dataDir;
  +          Restart = "always";
  +          User = "cfssl";
  +
  +          ExecStart = with cfg; let
  +            opt = n: v: optionalString (v != null) ''-${n}="${v}"'';
  +          in
  +            lib.concatStringsSep " \\\n" [
  +              "${pkgs.cfssl}/bin/cfssl serve"
  +              (opt "address" address)
  +              (opt "port" (toString port))
  +              (opt "ca" ca)
  +              (opt "ca-key" caKey)
  +              (opt "ca-bundle" caBundle)
  +              (opt "int-bundle" intBundle)
  +              (opt "int-dir" intDir)
  +              (opt "metadata" metadata)
  +              (opt "remote" remote)
  +              (opt "config" configFile)
  +              (opt "responder" responder)
  +              (opt "responder-key" responderKey)
  +              (opt "tls-key" tlsKey)
  +              (opt "tls-cert" tlsCert)
  +              (opt "mutual-tls-ca" mutualTlsCa)
  +              (opt "mutual-tls-cn" mutualTlsCn)
  +              (opt "mutual-tls-client-key" mutualTlsClientKey)
  +              (opt "mutual-tls-client-cert" mutualTlsClientCert)
  +              (opt "tls-remote-ca" tlsRemoteCa)
  +              (opt "db-config" dbConfig)
  +              (opt "loglevel" (toString logLevel))
  +            ];
  +        }
  +        (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {
  +          StateDirectory = baseNameOf cfg.dataDir;
  +          StateDirectoryMode = 700;
  +        })
  +      ];
       };
   
       services.cfssl = {
  
positive.code: 
      users.extraUsers.cfssl = {
        description = "cfssl user";
        createHome = true;
        home = cfg.dataDir;
        group = "cfssl";
        uid = config.ids.uids.cfssl;
  
negative.code:     dataDir = mkOption {
        default = "/var/lib/cfssl";
        type = types.path;
        description = ''
          The work directory for CFSSL.
  
          <note><para>
            If left as the default value this directory will automatically be
            created before the CFSSL server starts, otherwise you are
            responsible for ensuring the directory exists with appropriate
            ownership and permissions.
          </para></note>
        '';
      };
  
      address = mkOption {
  