anchor.diff:          description = "Contact email address for the CA to be able to reach you.";
         };
   
  +      user = mkOption {
  +        type = types.str;
  +        default = "root";
  +        description = "User under which simp_le would run.";
  +      };
  +
  +      group = mkOption {
  +        type = types.str;
  +        default = "root";
  +        description = "Group under which simp_le would run.";
  +      };
  +
  +      postRun = mkOption {
  +        type = types.lines;
  +        default = "";
  +        example = "systemctl reload nginx.service";
  +        description = ''
  +          Commands to run after certificates are re-issued. Typically
  +          the web server and other servers using certificates need to
  +          be reloaded.
  +        '';
  +      };
  +
         plugins = mkOption {
           type = types.listOf (types.enum [
             "cert.der" "cert.pem" "chain.der" "chain.pem" "external_pem.sh"
  -          "fullchain.der" "fullchain.pem" "key.der" "key.pem"
  +          "fullchain.der" "fullchain.pem" "key.der" "key.pem" "account_key.json"
           ]);
  -        default = [ "fullchain.pem" "key.pem" ];
  -        description = "Plugins to enable.";
  +        default = [ "fullchain.pem" "key.pem" "account_key.json" ];
  +        description = ''
  +          Plugins to enable. With default settings simp_le will
  +          store public certificate bundle in <filename>fullchain.pem</filename>
  +          and private key in <filename>key.pem</filename> in its state directory.
  +        '';
         };
   
         extraDomains = mkOption {
  -        default = [ ];
  -        type = types.listOf types.str;
  -        description = "More domains to include in the certificate.";
  -        example = [ "example.com" "foo.example.com:/var/www/foo" ];
  +        type = types.attrsOf (types.nullOr types.str);
  +        default = {};
  +        example = {
  +          "example.org" = "/srv/http/nginx";
  +          "mydomain.org" = null;
  +        };
  +        description = ''
  +          Extra domain names for which certificates are to be issued, with their
  +          own server roots if needed.
  +        '';
         };
       };
     };
  
positive.code:   ###### implementation
    config = mkIf (cfg.certs != { }) {
  
      systemd.services = flip mapAttrs' cfg.certs (cert: data: nameValuePair
        ("simp_le-${cert}")
        ({
          description = "simp_le cert renewal for ${cert}";
          after = [ "network.target" ];
          serviceConfig = {
            Type = "oneshot";
            SuccessExitStatus = "0 1";
          };
          preStart = ''
            mkdir -p "${cfg.directory}/${cert}"
          '';
          script = ''
            WEBROOT="${optionalString (data.webroot == null) data.webroot}"
            cd "${cfg.directory}/${cert}"
            ${pkgs.simp_le}/bin/simp_le -v \
              ${concatMapStringsSep " " (p: "-f ${p}") data.plugins} \
              -d ${cert} --default_root "$WEBROOT" \
              ${concatMapStringsSep " " (p: "-d ${p}") data.extraDomains} \
              ${optionalString (data.email != null) "--email ${data.email}"} \
              --valid_min ${toString data.validMin}
          '';
        })
      );
  
negative.code:   certOpts = { ... }: {
      options = {
        webroot = mkOption {
          type = types.str;
          description = ''
            Where the webroot of the HTTP vhost is located.
            <filename>.well-known/acme-challenge/</filename> directory
            will be created automatically if it doesn't exist.
            <literal>http://example.org/.well-known/acme-challenge/</literal> must also
            be available (notice unencrypted HTTP).
          '';
        };
  
        validMin = mkOption {
  