{
  options,
  config,
  lib,
  fn,
  pkgs,
  ...
}:
with builtins;
with lib; let
  cfg = config.machine;
in
  mkIf (elem "acme" cfg.services) {
    security.acme = {
      # see https://letsencrypt.org/repository/
      acceptTerms = true;
      defaults.email = "${(elemAt cfg.mailAccounts 0).name}@${cfg.domain}";
    };
  }