nixos/security: add acme through dns challenge

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/modules/nginx.nix

@@ -4,8 +4,12 @@ let
 
   mkVhost =
     attrs:
+    let
+      isAcme = config.acme.enable;
+    in
     {
-      forceSSL = false; # TODO: tweak per host
+      forceSSL = isAcme;
+      useACMEHost = if isAcme then fqdn else null;
     }
     // attrs;