chore: migrate nine host

modules/acme/default.nix

@@ -0,0 +1,21 @@
+{ config, ... }: let
+  inherit (config.networking) domain;
+in {
+  secrets.acmeEnvironment.file = ./environment.age;
+
+  security.acme = {
+    acceptTerms = true;
+
+    defaults = {
+      environmentFile = config.secrets.acmeEnvironment.path;
+      dnsProvider     = "cloudflare";
+      dnsResolver     = "1.1.1.1";
+      email           = "security@${domain}";
+    };
+
+    certs.${domain} = {
+      extraDomainNames = [ "*.${domain}" ];
+      group            = "nginx";
+    };
+  };
+}

modules/acme/environment.age

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw /sYx2CZG4l/oWbh9aKT4lFOcSiwY6A9SxwgX32mXqBs
+iK6qzFpI4xGh5m4oqmW18eM2v6OVj/z3t1aRslnhH50
+-> ssh-ed25519 spFFQA S3tkGQbTGQgWcp8Uh625eMCnE/h4nFVeb/z1AVemBkw
+9RiAPo2w7PC+2abVofU1Aficcn0eOfvvOMgxGXRIL+0
+-> ssh-ed25519 dASlBQ zuVu1QbtutWUG93M+i/UlVlkrmUdz71SrW8jhV4Pxg4
+OMEdnXV0Ix11FRX58Q3zH7nRG2tSkBl1wDmGY7J4JLM
+-> ssh-ed25519 CzqbPQ XLqIYDBAQXyL4/khZ71XP6uajnkX2HhzA2Ksx1UTGiU
+MWrt9f1XjxECD4TRKbME2bN4XU1ns9VQ7btuqijXJYU
+--- rpTCT+04nE+Jl+2qDHbocBGeYQYBtW/EcRiYHWTqcvw
+ñP3ÐÔ¢p
¸ŸQ¬^“¬­ ³š8lA<6C>¶Å»‰ÌhYQê±	Gü×ÿ‘¢ðWÐüÊ'ï&ãתHÐÉ;Ü<>ï ¼	á*3™­û Ð÷
+t€AõàOXkˆ>M¸††öiœ:!äo¸Ì›s9å!:£$£rŽ»ÿaŽ4"HUD
+Œ¾ËbHºôH£–w'Å Ì<C2A0>Ù±x·³ÌJ¨<>àXœYy«+å–ú¡P»(‹eG&&ŽTGÐ'ÔÍ8à:!)Ôª<´