{ config, lib, ... }:
let
  # Every host is issued the same way: a DNS-01 challenge through Hetzner.
  hetznerCert = {
    dnsProvider = "hetzner";
    environmentFile = config.age.secrets.hetzner-dns.path;
    group = "nginx";

    # Flag names are lego v5's (v4 spelled them --dns.propagation-wait and
    # --dns-timeout).
    extraLegoFlags = [
      "--dns.resolvers=1.1.1.1:53,8.8.8.8:53"
      "--dns.propagation.wait=60s" # Wait for 60 seconds for DNS propagation
      "--dns.timeout=60"
      "--http-timeout=60"
    ];
  };
in
{
  security.acme = {
    acceptTerms = true;

    defaults = {
      email = "acme@ppp.pm";
    };

    certs = lib.genAttrs [
      "ha.ppp.pm"
      "komga.ppp.pm"
      "romm.ppp.pm"
      "puppy.ppp.pm"
      "todo.ppp.pm"
      "schema.ppp.pm"
    ] (_: hetznerCert);
  };

  age = {
    secrets = {
      "hetzner-dns".file = ../../../../secrets/manatee/hetzner-dns.age;
    };
  };
}