diff --git a/applications/acme.nix b/applications/acme.nix
index 103a639..a89e209 100644
--- a/applications/acme.nix
+++ b/applications/acme.nix
@@ -1,29 +1,45 @@
-{ config, ... }:{
-  # group that will own the certificates
-  users.groups.acme = {};
+{ pkgs, lib, ... }:
+  with lib;
+  let
+    cfg = config.services.skynet_acme;
+  in {
 
-  age.secrets.acme.file = ../secrets/dns_certs.secret.age;
+  imports = [];
 
-  security.acme = {
-    preliminarySelfsigned = false;
-    acceptTerms = true;
+  options.services.skynet_acme = {
+    enable = mkEnableOption "Skynet Lets Encrypt certs";
 
-    defaults = {
-      email = "admin_acme@skynet.ie";
-      # we use our own dns authorative server for verifying we own the domain.
-      dnsProvider = "rfc2136";
-      credentialsFile = config.age.secrets.acme.path;
+    domains = lib.mkOption {
+      default = [ ];
+      type = lib.types.listOf lib.types.str;
+      description = ''
+        A list of domains to use for this server.
+      '';
     };
+  };
 
-    certs = {
-      "skynet" = {
-        domain = "skynet.ie";
-        extraDomainNames = [
-          "*.skynet.ie"
-          "*.minecraft.games.skynet.ie"
-          "*.pages.skynet.ie"
-          "api.account.skynet.ie"
-        ];
+  config = {
+    # group that will own the certificates
+    users.groups.acme = {};
+
+    age.secrets.acme.file = ../secrets/dns_certs.secret.age;
+
+    security.acme = {
+      preliminarySelfsigned = false;
+      acceptTerms = true;
+
+      defaults = {
+        email = "admin_acme@skynet.ie";
+        # we use our own dns authorative server for verifying we own the domain.
+        dnsProvider = "rfc2136";
+        credentialsFile = config.age.secrets.acme.path;
+      };
+
+      certs = {
+        "skynet" = {
+          domain = "skynet.ie";
+          extraDomainNames = cfg.domains;
+        };
       };
     };
   };