Thanks @tomprince!

Copy everything from how the issuer does it.

The Blackbox exporter can be used to check whether some services do answer;
We'll use it for our HTTPS endpoints.
Especially handy is it's checking for TLS cert expiry.

Epiphany: Systemd reads more than a single environment file. This
lets me improve the file naming much.

Unfortunately still prints a bold warning on deployment.

This will store the supposedly secret URL in the Nix Store and
print a honking big warning about it.

It looks like this may have been originally copied from a newer nixpkgs
since it wasn't in our nixpkgs fork.

The differences I can see:
- Details of `sudoer` file, some of which appear to be duplicates.
- `jq` and `gnumake` are not on the system path
- `vagrant` user is in group `users` instead of `vagrant`.

This lets other modules override these settings.

As per @jcalderone and @florian videoconf on 2021-08-06.

- Remove custom handling of Let's Encrypt certs, use NixOs' ACME
  integration instead.

- Use NGINX for TLS termination.

NGINX does longest-prefix-match for selecting locations.

This should let it work for both enabled and disabled configurations