nix-infra/config/hosts/mail-2/acme.nix

{ ... }:
{
  security.acme.certs = {
    "mail-2.grzb.de" = {
      listenHTTP = ":80";
      reloadServices = [ "postfix.service" ];
    };
  };
}