{ config, pkgs, ...}: {
  security.acme.acceptTerms = true;
  security.acme.defaults.email = "acme@tempest.dev";

  security.acme.certs."wildcard-irc.tempest.dev" = {
    group = "pounce";
    domain = "*.irc.tempest.dev";
    dnsProvider = "namecheap";
    credentialsFile = "/var/lib/secrets/namecheap.env";
  };
}