Merge staging into production

• Split public and private keys (!114 (merged) and !116 (merged))
• Add payment server monitoring (!117 (merged))
• Minor nix-shell improvements (!111 (merged))
• CI improvements for docs (!113 (merged))
• Swap re-configuration (!103 (merged))
• morph node name simplification (!110 (merged))
• Refactored morph grid definition (!109 (merged))
• GSuite SSO for Grafana (!120 (merged))
• Upgrade systems to NixOS 21.05 (!121 (merged))
• Continuous deployment system (!115 (merged))
• Disable Grafana statistics reporting (!119 (merged))
• Try to fix the continuous deployment configuration (!124 (merged))
• Attempt to fix GitLab continuous deployment configuration (!126 (merged))
• Attempt to fix GitLab continuous deployment configuration (!128 (merged))
• Propagate morph exit status out of update script (!132 (merged))
• Supply ssh host keys to deployment script (!130 (merged))
• Prevent <nixpkgs> path from growing until it breaks nix tools (!131 (merged))
• Fix permissions on the deploy key so continuous deployment can authenticate (!134 (merged))
• Fix usage of the deploy key environment variable (!136 (merged))
• Fix whitespace problems with the deploy key that prevent it from being used (!138 (merged))
• Set initial Grafana web admin password (!123 (merged))

morph/grid/local/private-keys/README.rst

+Deployment Secrets
+==================
+
+Deploying PrivateStorageio requires certain secrets.
+For the localdev grid these secrets are kept in this (public) directory.
+This is intended to help make it as easy as possible to launch a local deployment.
+It also serves as an example of what secrets are required for any other deployment.
+
+You can find more information about some of these secrets in ``ops/generating-keys.rst``.
+
+deploy_key
+----------
+
+This is an SSH private key which will be authorized to trigger a deployment update on the deployment hosts themselves.
+The corresponding SSH public key is kept in the ``public-keys`` location.
+
+grafana-admin.password
+----------------------
+
+This is the initial admin password for the Grafana web admin on the monitoring host.
+
+stripe.secret
+-------------
+
+This is the Stripe secret key which the payment server uses to finalize payment processing using Stripe.
+The corresponding Stripe public key is kept in the ``public-keys`` location.
+
+ristretto.signing-key
+---------------------
+
+This is the Ristretto-group private key used by the ZKAP issuer.
+
+monitoringvpn
+-------------
+
+This directory holds Wireguard private keys for each of the hosts so they can participate in the deployment VPN.
+The corresponding public keys are kept in the ``public-keys`` location.
+
+payments-localdev-ssl
+---------------------
+
+This secret is *only* present for the localdev grid.
+This contains a TLS certificate and private key for the payment server.
+Other deployments will automatically generate a key and obtain a certificate from Let's Encrypt.