{
  config,
  pkgs,
  lib,
  ...
}: {
  # NOTE: Caddy handles all TLS natively via its ACME integration.
  # This module is kept as a fallback for non-Caddy services.
  # Currently NOT imported in default.nix — uncomment there to activate.
  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "jory@severijnse.eu";
      group = "caddy";
    };
  };
}