diff --git a/nixos-module/default.nix b/nixos-module/default.nix
index 275c0cd..02824ce 100644
--- a/nixos-module/default.nix
+++ b/nixos-module/default.nix
@@ -273,6 +273,20 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.proxy.ssl && cfg.domain == "localhost");
+        message = ''
+          services.hortusfox-web: proxy.ssl = true (the default) requests an
+          ACME certificate for services.hortusfox-web.domain, but domain is
+          left at its own default of "localhost" -- Let's Encrypt can never
+          issue a certificate for that, so this would only fail at runtime.
+          Set domain to a real, publicly resolvable FQDN, or set
+          proxy.ssl = false for a local/test deployment.
+        '';
+      }
+    ];
+
     users.users.${cfg.user} = {
       isSystemUser = true;
       group = cfg.group;