anchor.diff:          '';
         };
         tls_certificate_path = mkOption {
  -        type = types.str;
  -        default = "/var/lib/matrix-synapse/homeserver.tls.crt";
  +        type = types.nullOr types.str;
  +        default = null;
  +        example = "/var/lib/matrix-synapse/homeserver.tls.crt";
           description = ''
             PEM encoded X509 certificate for TLS.
             You can replace the self-signed certificate that synapse
  
positive.code:       after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
        preStart = ''
          if ! test -e /var/lib/matrix-synapse; then
            mkdir -p /var/lib/matrix-synapse
            chmod 700 /var/lib/matrix-synapse
            chown -R matrix-synapse:matrix-synapse /var/lib/matrix-synapse
            ${cfg.package}/bin/homeserver --config-path ${configFile} --keys-directory /var/lib/matrix-synapse/ --generate-keys
          fi
        '';
        serviceConfig = {
          Type = "simple";
  
negative.code:       };
        tls_private_key_path = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "/var/lib/matrix-synapse/homeserver.tls.key";
          description = ''
            PEM encoded private key for TLS. Specify null if synapse is not
            speaking TLS directly.
          '';
        };
        tls_dh_params_path = mkOption {
          type = types.nullOr types.str;
          default = null;
          example = "/var/lib/matrix-synapse/homeserver.tls.dh";
          description = ''
            PEM dh parameters for ephemeral keys
          '';
  