This causes NixOS to generate the systemd timer unit for us and saves us
having to explain a lot of subtle systemd features.

It does pin execution to midnight on Monday but scaling to handle load spikes
is Let's Encrypt's problem, I guess.

The nixpkgs fork already contains all of the changes our overlays were
responsible for - but as direct nixpkgs changes instead.

And test for (kind of) SSH availability

The new version of PaymentServer has incompatible changes that require this.

so it won't be running yet when this runs

right???

reordering/reformatting just to make commenting easier

maybe the other systemd timer fires right away too

why make it a plugin, then, you may ask.
or perhaps you may not ask.

Let us pick Ristretto and supply a key if we like.

The issuer runs.  Helpers to poke the right API calls into the right place
forthcoming...