{
  config,
  lib,
  ...
}:
{
  age.secrets = {
    acme.file = ../../../secrets/acme.age;
  };

  users.groups.acme.members = [ "caddy" ];

  security.acme = {
    defaults = {
      reloadServices = [ "caddy" ];

      environmentFile = config.age.secrets.acme.path;
    };
    acceptTerms = true;
  };

  services.caddy = {
    enable = true;
    openFirewall = true;
    group = "caddy";
    virtualHosts = {
      "${config.networking.fqdn}" = {
        extraConfig = lib.mkDefault ''
          respond * 204
        '';
      };
    };
  };
  systemd.services.caddy.serviceConfig = {
    UMask = "007";
    LogsDirectoryMode = "750";
  };
}