Motivation for this change

#24731. I want to be able to have separate certificates for different services (SMTP, XMPP, IMAP, HTTP, etc.) Aside from a general sense that this is the Right Way to do things, some of these services run as different users/groups, and it's thus difficult to generate a single certificate they can all read.

With the domain option, I can use the following (taken directly from my config) to create a separate certificate for each service:

    security.acme.certs."prosody-kdf.sh" ={
      domain = "kdf.sh";
      group = "prosody";
      allowKeysForGroup = true;
      webroot = config.security.acme.certs."kdf.sh".webroot;
};

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.