{ ... }:
{
  # Ensure Caddy can access the ACME certificates
  users.users.caddy.extraGroups = [ "acme" ];
}