nixos/hosts/delta/acme.nix

{...}: {
  security.acme.certs."caspervk.net" = {
    domain = "*.caspervk.net";
    reloadServices = [];  # unbound.service
  };
  users.groups.acme.members = [];  # unbound
}