diff --git a/modules/nixos/clicks/security/acme/default.nix b/modules/nixos/clicks/security/acme/default.nix
new file mode 100644
index 0000000..655e39f
--- /dev/null
+++ b/modules/nixos/clicks/security/acme/default.nix
@@ -0,0 +1,42 @@
+# SPDX-FileCopyrightText: 2024 Auxolotl Infrastructure Contributors
+# SPDX-FileCopyrightText: 2024 Clicks Codes
+#
+# SPDX-License-Identifier: GPL-3.0-only
+
+{ lib, config, ... }:
+let
+  cfg = config.clicks.security.acme;
+in
+{
+  options.clicks.security.acme = {
+    enable = lib.mkEnableOption "Acme defaults";
+
+    email = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = "Email address to use for Let's Encrypt registration.";
+    };
+
+    staging = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Use the Let's Encrypt staging server.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.acme = {
+      acceptTerms = true;
+
+      defaults = {
+        inherit (cfg) email;
+
+        group = lib.mkIf config.services.nginx.enable "nginx";
+        server = lib.mkIf cfg.staging "https://acme-staging-v02.api.letsencrypt.org/directory";
+
+        # Reload nginx when certs change.
+        reloadServices = lib.optional config.services.nginx.enable "nginx.service";
+      };
+    };
+  };
+}