firewall.nix: Don't make missing rpfilter support a fatal error

This makes upgrading from Linux 3.2 to 3.4 a bit nicer.
firewall.nix: Less verbosity
Add support for opportunistic TCP encryption.

Set "networking.tcpcrypt.enable = true;" to enable opportunistic TCP encryption
based on the user-space tools available from <http://tcpcrypt.org>.

Network attackers come in two varieties: passive and active (man-in-the-middle).
Passive attacks are much simpler to execute because they just require listening
on the network. Active attacks are much harder as they require listening and
modifying network traffic, often requiring very precise timing that can make
some attacks impractical.

Opportunistic encryption cannot protect against active attackers, but it *does*
protect against passive attackers. Furthermore, Tcpcrypt is powerful enough to
stop active attacks, too, if the application using it performs authentication.

A complete description of the protocol extension can be found at
<http://tools.ietf.org/html/draft-bittau-tcp-crypt-00>.
modules/misc/ids.nix: add a comment explaining why tcpcryptd has uid 666.
modules/services/networking/tcpcrypt.nix: specify start-up dependencies in systemd style

Thanks, Eelco, for pointing this out.
modules/misc/ids.nix: patch tcpcrypt to use our uid

The default uid 666 exceeds SYS_UID_MAX (499), so it might not be available
anyway.
lightdm: Use xserver.nix environment variables when starting X

This reduces code duplication, but more importantly means that the
DRI modules can be found by X enabling hardware acceleration.

Close #249; the PR also refers to more about DRI modules.
/etc/profile: try all nix profiles for ASPELL_CONF

Aspell can only handle one dict-dir directive and currently we hardocde
that to
  ASPELL_CONF="dict-dir $HOME/.nix-profile/lib/aspell"

This means that aspell doesn't work if it is installed to the system or
default nix profile -- it only works in the user profile.

With this change, aspell can be installed to any of the nix profiles. If
it is installed in more than one profile, the most "local" profile wins
(i.e. sysadmin can set up a default, users can override it).
release.nix: Automatically include all of tests/default.nix
Test whether the transparent fetchurl cache (tarballs.nixos.org) works

Testing this is useful in any case, but it's necessary now because Nix
1.6 doesn't check the binary cache for fetchurl output anymore.

http://hydra.nixos.org/build/6144188
nixos-install: Fix copying from the CD

Nix 1.6 doesn't run the copy-from-other-stores substituter by default
anymore, so turn it on explicitly.

http://hydra.nixos.org/build/6144173
Add kexec support

You can now do a fast reboot (bypassing the BIOS, which may take
several minutes on servers) by running ‘systemctl kexec’.

Unfortunately the QEMU test for this is unreliable due to a QEMU bug
(it randomly crashes with a message like ‘Guest moved used index from
8 to 0’), so it's commented out.
Set CURL_CA_BUNDLE env variable for nix-daemon to allow pulling from a binary cache on https. Did not add to nix.envVars to avoid being added to shellInit.
bind: allow forwarders to differ from nameservers
modules/misc/ids.nix: document the fact that the uid for tcpcryptd is hard-coded in the daemon
Regression test for blkio functionality
manual: fix typo, #254.
Merge pull request #257 from oxij/bind-forwarders

bind: allow forwarders to differ from nameservers
services.cgminer.enable: improve description

So that a search for "bitcoin" in the configuration.nix(5) man page
yields a hit.
Write a reboot record to /var/log/wtmp