group = mkOption {
        type = types.str;
        inherit (defaultAndText "group" "acme") default defaultText;
        description = "Group running the ACME client.";
      };

i feel like this description is inaccurate?

        # Group might change between runs, re-apply it
        chown '${user}:${data.group}' certificates/*

hm

Secondly there was in the past some concern raised around granting acme group to other services because it would grant that service access to more certs than you may want. You might get some backlash in that regard. In reality, this is hard to operate around and for wildcard certs you're likely to only have 1 cert shared across multiple services anyway.

so the thing about this point is that, like, if you set a specific group for a cert (that isn't acme), then its not like granting the acme group will give you access to those...