Goodies

* add nginx role (separate it from GH-25 as it can be used for other services)
* copy `getent` extras module (used by GH-25, but it can be used elsewhere)
* add a special worker account -- an account for non-privileged services/tasks
* fix the `local.yml` file (add secret loading and fix the first task's name)
That seems unnecessary here - we won't be using the corresponding enable/disable functionality