This results in less repetition, less abstraction leakage, and provides more
power to the private-storage module (by exposing meaningful values instead of
Tahoe-LAFS config strings).

This is a bricked machine in the data center where running NixOS is hard.

Add a basic NixOS Private Storage service module.

Also, comments.

At some point some issue was introduced into the nix store cache on CircleCI.
Restoring the cache is currently half failing and causes `nix-build` to fail
to find `nixpkgs`.

Randomly guessing custom CircleCI git implementation doesn't support custom
deploy keys?