add ddns, wireguard server

hosts/fw.cloonar.com/modules/unbound.nix

@@ -3,6 +3,7 @@
     enable = true;
     server = {
       interface = [ "10.42.96.1" "10.42.97.1" "10.42.99.1" "10.42.254.1" ];
+      tls-cert-bundle = "/var/lib/acme/fw.cloonar.com/fullchain.pem"
     };
     local-data = [
       "localhost A 127.0.0.1"
@@ -65,7 +66,6 @@
       "10.42.97.9 cl-storage-01.cloonar.com"
       "10.42.97.118 git.cloonar.com"
 
-
       "10.254.235.22 stage.wsw.at"
       "10.254.217.23 prod.wsw.at"
       "10.254.240.109 wohnservice-wien.at"
@@ -113,4 +113,10 @@
       }
     ];
   };
+
+  security.acme.certs.fw = {
+    domain = "fw.cloonar.com";
+    user = config.services.unbound.user;
+    group = config.services.unbound.group;
+  };
 }