Merge staging into production

• Split public and private keys (!114 (merged) and !116 (merged))
• Add payment server monitoring (!117 (merged))
• Minor nix-shell improvements (!111 (merged))
• CI improvements for docs (!113 (merged))
• Swap re-configuration (!103 (merged))
• morph node name simplification (!110 (merged))
• Refactored morph grid definition (!109 (merged))
• GSuite SSO for Grafana (!120 (merged))
• Upgrade systems to NixOS 21.05 (!121 (merged))
• Continuous deployment system (!115 (merged))
• Disable Grafana statistics reporting (!119 (merged))
• Try to fix the continuous deployment configuration (!124 (merged))
• Attempt to fix GitLab continuous deployment configuration (!126 (merged))
• Attempt to fix GitLab continuous deployment configuration (!128 (merged))
• Propagate morph exit status out of update script (!132 (merged))
• Supply ssh host keys to deployment script (!130 (merged))
• Prevent <nixpkgs> path from growing until it breaks nix tools (!131 (merged))
• Fix permissions on the deploy key so continuous deployment can authenticate (!134 (merged))
• Fix usage of the deploy key environment variable (!136 (merged))
• Fix whitespace problems with the deploy key that prevent it from being used (!138 (merged))
• Set initial Grafana web admin password (!123 (merged))

morph/grid/local/private-keys/README.rst

@@ -12,6 +12,7 @@ deploy_key
 ----------
 
 This is an SSH private key which will be authorized to trigger a deployment update on the deployment hosts themselves.
+The corresponding SSH public key is kept in the ``public-keys`` location.
 
 grafana-admin.password
 ----------------------
@@ -22,6 +23,7 @@ stripe.secret
 -------------
 
 This is the Stripe secret key which the payment server uses to finalize payment processing using Stripe.
+The corresponding Stripe public key is kept in the ``public-keys`` location.
 
 ristretto.signing-key
 ---------------------
@@ -31,7 +33,8 @@ This is the Ristretto-group private key used by the ZKAP issuer.
 monitoringvpn
 -------------
 
-This directory holds Wireguard keys for each of the hosts so they can participate in the deployment VPN.
+This directory holds Wireguard private keys for each of the hosts so they can participate in the deployment VPN.
+The corresponding public keys are kept in the ``public-keys`` location.
 
 payments-localdev-ssl
 ---------------------