{
  nodes,
  lib,
  ...
}: let
  inherit (nodes.acme.test-support.acme) caCert;
  inherit (nodes.acme.test-support.acme) caDomain;
in {
  security = {
    acme = {
      acceptTerms = true;
      defaults = {
        server = "https://${caDomain}/dir";
      };
    };

    pki = {
      certificateFiles = lib.mkForce [caCert];
    };
  };
}