ssl: Create a set of snakeoil certificates.

These are to be used during VM tests and obviously won't ensure much
privacy. We're going through an intermediate CA here, because we need to
test intermediate certs as well, especially because we're using two
intermediate certs from Thawte on our production servers.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
domains: Add an option to use snakeoil SSL certs.

This now generates snakeoil certs on the fly for every FQDN we're
defining in domains.nix.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
snakeoil: Use Nix expressions instead of keyfiles.

This is actually what's expected by the "vhosts" module, so let's
directly generate the values of the keys into a Nix expression.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
vhosts: Add key injector for snakeoil certs.

This inserts the snakeoil keys the same way as used in the keys system
from NixOps, so we can pretty much accurately test whether the real
deployment is going to fail.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
xmpp: Integrate vhost private keys into config.

Of course, magically this won't fix permissions, so MongooseIM still
won't be able to read the private key files. But at lest we have them in
place already.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
tests/headcounter: Enable snakeoil certificates.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
services/mongooseim: Allow access to /run/keys.

Not sure whether this is a good idea, especially because it makes sense
to separate privileges of the private keys from the MongooseIM service.

Fortunately, we have marked this as XXX, so I hope this gets cleaned up
before the final deployment.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>