Motivation for this change

Split out from #80856.

Responding to @m1cr0man from there:

The first two look good to me! I probably need this on my own setup with the 28 certs I'm trying to validate there, to avoid rate limits stuck_out_tongue

As for the additionalLegoRenewFlags, I actually had something similar (extraFlags) before I made the PR for lego (#77578, actually it was here) . I removed it because I felt it was too solution specific, and if we were to change acme clients again, this flag would have to be deprecated. With the other options like mustStaple and dnsPropagationCheck, at least if the next client has those features we can rewrite the arguments, but if people have random extra arguments then we can only break their configuration.

I am not against the idea either, for power users there is certainly desire to allow for custom flags to the service, but they run the above risk of it breaking some day. Would love to hear some other opinions on the matter. 🙂

I personally think that it's better for additionalLegoRenewFlags = ["--my-option"] to break cleanly at a later date than it is for people to be unable to use the NixOS module if they need additional configuration, but I realize that this is a somewhat philosophical difference. I made sure to include the name of the command in the configuration option so that there's no clash with a possible later additionalCertbotFlags or similar.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.