anchor.diff:  
         dnsProvider = mkOption {
           type = types.nullOr types.str;
  +        default = null;
           example = "route53";
  -        default = null;
           description = "DNS Challenge provider";
         };
   
  
positive.code:   certOpts = { name, ... }: {
      options = {
        webroot = mkOption {
          type = types.str;
          example = "/var/lib/acme/acme-challenges";
          description = ''
            Where the webroot of the HTTP vhost is located.
  
negative.code:           servicesAttr;
  
        systemd.tmpfiles.rules =
          map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));
  
        systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
          ("acme-${cert}")
  