security.acme = {
    acceptTerms = true;
    defaults.email = "conor+acme@domain.com";
    certs = {
      "conr.run" = {
        domain = "domain.com";
        group = "nginx";
        dnsProvider = "porkbun";
        environmentFile = "/var/lib/private/porkbun";
      };
    };
  }

In reply to @hexa:lossy.network
the nginx group apparently does not exist

hexa: do i need the lego command too? or just the first too lines?

PORKBUN_SECRET_API_KEY=xxxxxx \
PORKBUN_API_KEY=yyyyyy \
lego --email you@example.com --dns porkbun -d '*.example.com' -d example.com run
``

so i am getting a

2025/04/15 21:40:37 porkbun: some credentials info>
Apr 15 21:40:37 jubjub acme-jubjub.conr.run-start[48440]: + echo Failed to fetch certificates. This may mean>
Apr 15 21:40:37 jubjub acme-jubjub.conr.run-start[48440]: Failed to fetch certificates. This may mean your D>
Apr 15 21:40:37 jubjub acme-jubjub.conr.run-start[48440]: + exit 10

@hexa does your porkbun file look like this?

PORKBUN_SECRET_API_KEY=pk1_1234… \
PORKBUN_API_KEY=sk1_1234… \