_: {
  security.acme = {
    acceptTerms = true;
    defaults.email = "acme@buffet.sh";
    certs."buffet.sh" = {
      extraDomainNames = [
        "404.buffet.sh"
        "bitwarden.buffet.sh"
        "buffets.kitchen"
      ];
    };
  };
}