{ config, pkgs, ...}: {
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "acme@tempest.dev";

  security.acme.certs."wildcard-tempest.dev" = {
    domain = "*.tempest.dev";
    dnsProvider = "namecheap";
    credentialsFile = "/var/lib/secrets/namecheap.env";
    dnsPropagationCheck = false;
  };

  security.acme.certs."wildcard-irc.tempest.dev" = {
    domain = "*.irc.tempest.dev";
    dnsProvider = "namecheap";
    credentialsFile = "/var/lib/secrets/namecheap.env";
    dnsPropagationCheck = false;
  };
}