infra/config/acme.nix

{ config, ... }:
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "hey@winston.sh";
    certs."winston.sh" = {
      extraDomainNames = [ "*.winston.sh" ];
      dnsProvider = "porkbun";
      credentialsFile = config.age.secrets."lego/porkbun-credentials".path;
    };
  };
}