let
  poorObfuscation = y: x: "${x}@${y}";
in
{
  security.acme = {
    acceptTerms = true;
    defaults.email = poorObfuscation "sefidel.com" "postmaster";
    certs = {
      "sefidel.com" = {
        domain = "*.sefidel.com";
        dnsProvider = "hetzner";
        dnsPropagationCheck = true;
        credentialsFile = "/persist/secrets/hetzner.key";
      };
    };
  };

  environment.persistence."/persist".directories = [
    "/var/lib/acme"
  ];

  deployment.keys."hetzner.key" = {
    keyCommand = [ "pass" "show" "server/hetzner-dns" ];
    destDir = "/persist/secrets";
  };
}