{ ... }:
{
  security.acme.defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
  security.acme.preliminarySelfsigned = true;
}