{...}: {
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "alex@kassouni.net";
    certs."home.kassouni.net" = {
      dnsProvider = "cloudflare";
      extraDomainNames = [ "*.home.kassouni.net" ];
      environmentFile = "/var/lib/cloudflare/dns-01-challenge";
      group = "nginx";
    };
  };
}