{ config, ... }:

{
  security.acme = {
    email = "letsencrypt@spacekookie.de";
    acceptTerms = true;
  };
  
  # `hyperion.kookie.space` needs a cert for IRC  
  security.acme.certs."hyperion.kookie.space" = {
    webroot = "/var/lib/acme/acme-challenge";
    group = "tls";
  };

  # Other certificates on the spacekookie.de namespace
  security.acme.certs."spacekookie.de" = {
    webroot = "/var/lib/acme/acme-challenge";
    extraDomainNames = [
      "www.spacekookie.de"

      # Prosody related certificates
      "xmpp.spacekookie.de"
      "guest-xmpp.spacekookie.de"
      "rooms.spacekookie.de"

      # Public dev tools
      "git.spacekookie.de"
      "dev.spacekookie.de"
      "stream.spacekookie.de"
    ];
    group = "tls";
  };
}