nixos/security: add acme through dns challenge

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/modules/dns.nix

@@ -1,6 +1,16 @@
 { config, lib, ... }:
 let
-  agenixDnsDir = ../../agenix/dns + "/${config.dns.domain}";
+  cfg = config.dns;
+
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    strings
+    ;
+
+  inherit (config.networking) fqdn;
+
+  agenixDnsDir = "${self}/agenix/dns/${fqdn}";
   agenixKeys = builtins.attrNames (builtins.readDir agenixDnsDir);
 
   keys = map (
@@ -18,7 +28,7 @@ let
     {
       name = zoneDomain;
       path = config.age.secrets."dns/${filename}".path;
-      type = if zoneDomain == config.dns.domain then zonesub else subdomain;
+      type = if zoneDomain == fqdn then zonesub else subdomain;
     }
   ) agenixKeys;
 
@@ -34,11 +44,6 @@ in
     enable = mkEnableOption "" // {
       default = true;
     };
-
-    domain = mkOption {
-      type = with lib.types; str;
-      default = config.networking.fqdn;
-    };
   };
 
   config = mkIf cfg.enable {
@@ -53,7 +58,8 @@ in
           value = {
             file = path;
             group = "named";
-            owner = "named";
+            owner = if config.acme.enable then "acme" else "named";
+            mode = "440";
           };
         }
       ) agenixKeys
@@ -65,7 +71,7 @@ in
       extraConfig = builtins.concatStringsSep "\n" (map (key: "include \"${key.path}\";") keys);
 
       zones = {
-        "${config.dns.domain}" = {
+        "${fqdn}" = {
           # grant "tuxcord.net" zonesub ANY;
           extraConfig = ''
             update-policy {
@@ -74,7 +80,7 @@ in
               )}
             };
           '';
-          file = "/var/dns/${config.dns.domain}.zone"; # need to put default stuff
+          file = "/var/dns/${fqdn}.zone"; # need to put default stuff
           master = true;
         };
       };