satellite/hosts/nixos/common/optional/services/acme/default.nix

{ config, ... }: {
  sops.secrets.porkbun_secrets.sopsFile = ./secrets.yaml;
  security.acme.acceptTerms = true;
  security.acme.defaults = {
    email = "acme@moonythm.dev";
    dnsProvider = "porkbun";
    environmentFile = config.sops.secrets.porkbun_secrets.path;
  };

  environment.persistence."/persist/state".directories = [
    "/var/lib/acme"
  ];
}