@@ -8,25 +8,17 @@ imports = [
     ../settings/services/caddy.nix
   ];
   age.secrets = {
-    acme.file = ../../secrets/acme.age;
     # TS_AUTHKEY for caddy-tailscale plugin
     caddy.file = ../../secrets/caddy.age;
   };
 
-  security.acme = {
-    defaults = {
-      email = "security@${config.networking.domain}";
-      dnsProvider = "pdns";
-      validMinDays = 32;
-
-      environmentFile = config.age.secrets.acme.path;
-
-      server = "https://acme-api.actalis.com/acme/directory";
-      extraLegoFlags = [ "--eab" ]; # environmentFile must contain LEGO_EAB_KID and LEGO_EAB_HMAC
-    };
-    acceptTerms = true;
+  security.acme.defaults = {
+    email = "security@${config.networking.domain}";
+    dnsProvider = "pdns";
+    validMinDays = 32;
   };
 
+  services.tailscale.permitCertUid = config.services.caddy.user;
   services.caddy = {
     environmentFile = config.age.secrets.caddy.path;
     package = pkgs.caddy.withPlugins {
@@ -38,8 +30,6 @@ "github.com/caddy-dns/rfc2136@v1.0.0"
       ];
       hash = "sha256-SzD72CcYhIMvmgteHI4gyhEU41gExSMEzm1GvxE2ZQY=";
     };
-    email = config.security.acme.defaults.email;
-    acmeCA = config.security.acme.defaults.server;
     globalConfig = ''
       cache
       servers {
@@ -63,10 +53,6 @@ key_alg hmac-sha512
         key "{env.DDNS_TSIG_KEY}"
         server [::1]:53
       }
-      acme_eab {
-        key_id {$EAB_KEY_ID}
-        mac_key {$EAB_MAC_KEY}
-      }
     '';
   };
 
@@ -109,10 +95,10 @@ "net.ipv4.tcp_rmem" = "4096 87380 ${toString buffer_size}";
       "net.ipv4.tcp_wmem" = "4096 87380 ${toString buffer_size}";
       "net.ipv4.tcp_mem" = "${mem} ${mem} ${mem}";
 
-      "net.ipv4.tcp_sack" = false;
-      "net.ipv4.tcp_dsack" = false;
+      "net.ipv4.tcp_sack" = 0;
+      "net.ipv4.tcp_dsack" = 0;
 
-      "net.ipv4.tcp_slow_start_after_idle" = false;
+      "net.ipv4.tcp_slow_start_after_idle" = 0;
     };
 
 }