{ ... }:
{
  security.acme = {
    acceptTerms = true;

    defaults = {
      email = "acme@ppp.pm";
    };

    certs = {
      "ppp.pm" = {
        webroot = "/var/lib/acme/acme-challenge/";
        group = "nginx";
      };

      "git.ppp.pm" = {
        webroot = "/var/lib/acme/acme-challenge/";
        group = "nginx";
      };

      "whib-api.ppp.pm" = {
        webroot = "/var/lib/acme/acme-challenge/";
        group = "nginx";
      };
    };
  };
}