anchor.diff:              ${data.postRun}
             fi
           '');
  -      };
  +
  +      } // (optionalAttrs (data.webroot != null) {
  +        # Lego always tries to create .well-known/acme-challenge, but if webroot is owned
  +        # by the wrong user then it will crash and break cert renewal.
  +        ExecStartPre = "+" + pkgs.writeShellScript "acme-${cert}-make-webroot" ''
  +          mkdir -p '${data.webroot}/.well-known/acme-challenge'
  +          cd '${data.webroot}'
  +          chown 'acme:${data.group}' . .well-known .well-known/acme-challenge
  +        '';
  +      });
   
         # Working directory will be /tmp
         script = ''
  
positive.code:   in {
      inherit accountHash cert selfsignedDeps;
  
      webroot = data.webroot;
      group = data.group;
  
      renewTimer = {
  
negative.code: 
          StateDirectory = "acme/${cert}";
  
          BindPaths = [
            "/var/lib/acme/.minica:/tmp/ca"
            "/var/lib/acme/${cert}:/tmp/${keyName}"
          ];
        };
  
        # Working directory will be /tmp
  