Make fail2ban a normal systemd service in nixos module.
Limit the location where fail2ban service can write to (only /var/run/fail2ban).
Limit the capabilities of what fail2ban service can do. Taken from ArchLinux wiki.
venus: Support https
nixos-rebuild: Allow to use --repair.

Unfortunately, the flag only works directly and without the daemon, so
this adds an extra variable $repair, to avoid the daemon. This is to
avoid to iterate through the $extraBuildFlags just to test whether
"--repair" exists.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Fix ReadWriteDirectories for fail2ban, added /var/tmp.