This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

Monitoring: Set admin PW

See merge request !123

Fix deployment key whitespace

Closes #77

See merge request !138

This makes it easier to test outside of GitLab and it also means we don't
depend on whatever wacko shell settings we inherit from GitLab.

Use a new variable which actually holds a path

Closes #76

See merge request !136

Remove group and other permissions from the deploy key

Closes #75

See merge request !134

Propagate morph success/failure out of update-deployment

Closes #74

See merge request !132

Burn in some SSH host key knowledge

Closes #71

See merge request !130

Bounded NIX_PATH

Closes #72

See merge request !131

We can't point it at a Nix expression that evaluates to our desired version of
nixpkgs because certain consumers want it to be a filesystem path instead.

This is what we wanted and much more directly.  It also avoids the gradual
lengthening of the path by always setting the path to nixpkgs-2105 instead of
some derivative of whatever the path was last time.

This avoids a prompt at deploy time and the possibility of an MitM attack
against TOFU.

Various manually-tested fixes for the updater

Closes #70

See merge request !128

Use the GitLab-defined `CI_ENVIRONMENT_NAME`

Closes #69

See merge request !126

`name` does not exist.  I think the `environment` section of the configuration
tricked me.

Stop trying to hit a specific directory with mktemp

Closes #68

See merge request !124

Just use the configured temporary directory in the environment.  This is less
great but it's still okay because:

* It's our system
* The deploy key has limited capabilities

This commit does not change the semantics, only the looks.

Add GSuite SSO to Grafana

See merge request !120

At least it's easy to turn on

This is used in constructing the Google OAuth2 login callback URL and has to
match what's configured in Google - also helps if it is actually the address
of the server.

This should let it work for both enabled and disabled configurations