depot/cluster/services/certificates/default.nix

{
  services.certificates = {
    nodes = {
      internal-wildcard = [ "checkmate" "thunderskin" "VEGAS" ];
    };
    nixos = {
      internal-wildcard = [
        ./internal-wildcard.nix
      ];
    };
  };
}