Goodies

* add nginx role (separate it from GH-25 as it can be used for other services)
* copy `getent` extras module (used by GH-25, but it can be used elsewhere)
* add a special worker account -- an account for non-privileged services/tasks