{ lib, config, ... }:
with lib; mkIf (config.nginx.enable) {
  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "admin@ruject.fun";
      webroot = "/var/lib/acme/acme-challenge/";
    };
  };
}