It's not really a key, and not really public, but not secret either.
This way, the tests can run.

If I understand the behavior current Prometheus and Grafana
correctly, this should remove the port number from the
paymentserver labels in Prometheus TDSB.

Older versions of nixpkgs allowed you to specify multiple keys by having
newline separated keys in your string. However, this worked essentially by
accident, and is now explictly disallowed.

I noticed this because I had configured multiple keys for the local grid.  This
isn't currently impacting my ability to work, but it seems like a worthwhile
improvement anyway. This will be necessary (for example) if/when multiple people are
given root access to our storage nodes.

For some reason this had eluded my earlier grepping.

The VirtualBox documentation says this is the network to use for host-only
networking.

Copy everything from how the issuer does it.

The Blackbox exporter can be used to check whether some services do answer;
We'll use it for our HTTPS endpoints.
Especially handy is it's checking for TLS cert expiry.

Epiphany: Systemd reads more than a single environment file. This
lets me improve the file naming much.

Unfortunately still prints a bold warning on deployment.

This will store the supposedly secret URL in the Nix Store and
print a honking big warning about it.

This reduces the confusion with the nixos/modules/deployment.nix module,
and should make it clearer that it can contain any configuration that
applies to all hosts on the grid.