treewide: initialize npins

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/modules/dns.nix

@@ -82,21 +82,17 @@ in
       };
     };
 
-    environment.persistence."/persist".directories = [
+    environment.persistence."/persist" = {
+      directories = [
         {
           directory = "/var/dns";
           group = "named";
           user = "named";
         }
       ];
-
-    networking.firewall =
-      let
-        ports = [ config.services.bind.listenOnPort ];
-      in
-      {
-        allowedTCPPorts = ports;
-        allowedUDPPorts = ports;
     };
+
+    networking.firewall.allowedTCPPorts = [ config.services.bind.listenOnPort ];
+    networking.firewall.allowedUDPPorts = [ config.services.bind.listenOnPort ];
   };
 }