anchor.diff:        file = {
           group = "nginx";
           owner = "nginx";
  -        path = "/tmp/${host}-ca.pem";
  +        path = "/var/ssl/${host}-ca.pem";
         };
         label = "www_ca";
         profile = "three-month";
  
positive.code: 
          services.cfssl.enable = true;
          systemd.services.cfssl.after = [ "cfssl-init.service" "networking.target" ];
  
          systemd.services.cfssl-init = {
            description = "Initialize the cfssl CA";
  
negative.code:     certificate = {
        group = "nginx";
        owner = "nginx";
        path = "/var/ssl/${host}-cert.pem";
      };
      private_key = {
        group = "nginx";
        mode = "0600";
        owner = "nginx";
        path = "/var/ssl/${host}-key.pem";
      };
      request = {
        CN = host;
  