anchor.diff:  
         certs = mkOption {
           default = { };
  -        type = with types; attrsOf (submodule certOpts);
  +        type = with types; attrsOf (submodule [ (inheritableModule false) certOpts ]);
           description = ''
             Attribute set of certificates to get signed and renewed. Creates
             <literal>acme-''${cert}.{service,timer}</literal> systemd units for
  
positive.code: 
        postRun = mkOption {
          type = types.lines;
          default = if inheritDefaults then defaults.postRun else "";
          defaultText = mkDefaultText "''";
          example = "cp full.pem backup.pem";
          description = ''
            Commands to run after new certificates go live. Note that
  
negative.code: 
    certConfigs = mapAttrs certToConfig cfg.certs;
  
    # These options can be specified within
    # security.acme.defaults or security.acme.certs.<name>
    inheritableModule = isDefaults: { config, ... }: let
      defaultAndText = name: default: {
        # When ! isDefaults then this is the option declaration for the
        # security.acme.certs.<name> path, which has the extra inheritDefaults
        # option, which if disabled means that we can't inherit it
        default = if isDefaults || ! config.inheritDefaults then default else cfg.defaults.${name};
        # The docs however don't need to depend on inheritDefaults, they should
        # stay constant. Though notably it wouldn't matter much, because to get
        # the option information, a submodule with name `<name>` is evaluated
        # without any definitions.
        defaultText = if isDefaults then default else literalExpression "config.security.acme.defaults.${name}";
      };
    in {
      options = {
        validMinDays = mkOption {
          type = types.int;
          inherit (defaultAndText "validMinDays" 30) default defaultText;
          description = "Minimum remaining validity before renewal in days.";
        };
  
        renewInterval = mkOption {
          type = types.str;
          inherit (defaultAndText "renewInterval" "daily") default defaultText;
          description = ''
            Systemd calendar expression when to check for renewal. See
            <citerefentry><refentrytitle>systemd.time</refentrytitle>
  