{
  config,
  lib,
  ...
}:
{
  age.secrets = {
    acme.file = ../../../secrets/acme.age;
  };

  users.groups.acme.members = [ "caddy" ];

  security.acme = {
    defaults = {
      reloadServices = [ "caddy" ];

      environmentFile = config.age.secrets.acme.path;
      server = "https://acme-api.actalis.com/acme/directory";
      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
    };
    acceptTerms = true;
  };

  services.caddy = {
    enable = true;
    openFirewall = true;
    group = "caddy";
    email = config.security.acme.defaults.email;
    acmeCA = config.security.acme.defaults.server;
    globalConfig = ''
      acme_eab {
        key_id {$EAB_KEY_ID}
        mac_key {$EAB_MAC_KEY}
      }
    '';
    virtualHosts = {
      "${config.networking.fqdn}" = {
        extraConfig = lib.mkDefault ''
          respond * 204
        '';
      };
    };
  };
  systemd.services.caddy.serviceConfig = {
    UMask = "007";
    LogsDirectoryMode = "750";
  };
}