{
  security.acme.certs =
    let
      cloudflare = {
        dnsProvider = "cloudflare";
        credentialsFile = "/nix/persist/secret/cloudflare";
      };
    in
    {
      "sf.514fpv.io" = cloudflare;
      ".sf.514fpv.io" = cloudflare // {
        domain = "*.sf.514fpv.io";
      };
    };
}