diff --git a/config/locale.nix b/config/locale.nix
index 2858139..34158ea 100644
--- a/config/locale.nix
+++ b/config/locale.nix
@@ -1,8 +1,8 @@
 { config, pkgs, ... }:
 
 {
+  console.keyMap = "de";
   i18n = {
-    consoleKeyMap = "de";
     defaultLocale = "en_US.UTF-8";
 
     inputMethod = {
diff --git a/fn.nix b/fn.nix
index 411f7fd..bd0a071 100644
--- a/fn.nix
+++ b/fn.nix
@@ -5,6 +5,9 @@ with lib;
 
 rec {
   ifelse = a: b: c: if a then b else c;
+  fileContentsOr = a: b: (ifelse
+    (pathIsRegularFile a)
+    a b);
   cwd = toString ./.;
   lst = { p ? cwd, t ? "regular", b ? false }: (lists.forEach
     (attrNames
diff --git a/machines/Lilim/options.nix b/machines/Lilim/options.nix
index 8c906dc..279c92e 100644
--- a/machines/Lilim/options.nix
+++ b/machines/Lilim/options.nix
@@ -60,7 +60,7 @@ with lib;
       allowedUDPPortRanges = [ { from = 1714; to = 1764; } ];
       allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];
     };
-    desktop.wms = [ "i3" ];
+    desktop.wms = [ "none+i3" "i3" ];
   };
 
   config.system.copySysConf = {
diff --git a/services/acme.nix b/services/acme.nix
new file mode 100644
index 0000000..6fd29f6
--- /dev/null
+++ b/services/acme.nix
@@ -0,0 +1,17 @@
+{ options, config, lib, pkgs, ... }:
+
+with builtins;
+with lib;
+
+let
+  fn = import (../. + (toPath "/fn.nix")) { inherit lib; };
+  cfg = config.machine;
+in mkIf (elem "acme" cfg.services) {
+  security.acme = {
+    # see https://letsencrypt.org/repository/
+    acceptTerms = true;
+    email = fn.fileContentsOr
+      (toPath "${cfg.secretPath}/acme.mailAddr")
+      "${(elemAt cfg.mailAccounts 0).name}@${cfg.domain}";
+  };
+}
diff --git a/services/default.nix b/services/default.nix
index 7dc3c30..cd37302 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -1,5 +1,6 @@
 {
   imports = [
+    ./acme.nix
     ./cups.nix
     ./docker.nix
     ./fail2ban.nix
diff --git a/services/desktop.nix b/services/desktop.nix
index 041de5c..6413af7 100644
--- a/services/desktop.nix
+++ b/services/desktop.nix
@@ -40,9 +40,9 @@ in mkIf (elem "desktop" cfg.services) {
     enable = !(elem "sway" cfg.desktop.wms);
     layout = "de";
     videoDrivers = [ "intel" ];
+    displayManager.defaultSession = ifelse (cfg.desktop.wms != []) (elemAt cfg.desktop.wms 0) null;
     windowManager = mkIf (cfg.desktop.wms != []) {
       i3 = mkIf (elem "i3" cfg.desktop.wms) (import ./desktop/i3.nix { inherit pkgs; });
-      default = elemAt cfg.desktop.wms 0;
     };
     libinput = {
       enable = true;