treewide: initialize npins

few side refactors of this:
- no more `dns.domain`, it all must rely on `fqdn`, prevents
  inconsistencies.
- also added an specific host `tuxcord-acmetest` that uses the key zone
  for `nix.tuxcord.net` to test certificate pulling.

nixos/modules/dns.nix

@@ -82,17 +82,21 @@ in
       };
     };
 
-    environment.persistence."/persist" = {
-      directories = [
-        {
-          directory = "/var/dns";
-          group = "named";
-          user = "named";
-        }
-      ];
-    };
+    environment.persistence."/persist".directories = [
+      {
+        directory = "/var/dns";
+        group = "named";
+        user = "named";
+      }
+    ];
 
-    networking.firewall.allowedTCPPorts = [ config.services.bind.listenOnPort ];
-    networking.firewall.allowedUDPPorts = [ config.services.bind.listenOnPort ];
+    networking.firewall =
+      let
+        ports = [ config.services.bind.listenOnPort ];
+      in
+      {
+        allowedTCPPorts = ports;
+        allowedUDPPorts = ports;
+      };
   };
 }