Goodies

* add nginx role (separate it from GH-25 as it can be used for other services)
* copy `getent` extras module (used by GH-25, but it can be used elsewhere)
* add a special worker account -- an account for non-privileged services/tasks
* fix the `local.yml` file (add secret loading and fix the first task's name)
@benallard it's on Debian systems (or, probably, Linux ones).   FreeBSD does not have this.  And I agree w/ @djmitche, this is not going to be necessary in our case.