Fixes #81069

(cherry picked from commit 5ff9441)

Also separate directory and file permissions so the certificate files
don't end up with the executable bit.

Fixes #81335

(cherry picked from commit 3575555)

The configuration at https://ssl-config.mozilla.org/#server=nginx&config=intermediate
is reliably kept up-to-date in terms of security and compatible with a
wide range of clients. They've probably had more care and thought put
into them than our defaults, and will be easier to keep updated in
the future.

The only removed (rather than changed) configuration option here is
ssl_ecdh_curve, per mozilla/server-side-tls#189.

Resolves #80952.

(cherry picked from commit 4ed98d6)

[backport] nixos/nginx: use Mozilla Intermediate TLS configuration

(cherry picked from commit d0e0aca)

Includes some bugfixes/cleanups to the scripts and packaging, a run of the
updater and a bump of the version.

Fixes #75863

(cherry picked from commit 9131efe)

[20.03] nixos/acme: backport #81369 and #81371

(cherry picked from commit e881138)

[20.03] dhall-nix: Fix build

This prevents confusion by nix-env when installing packages by
derivation name, since there is another package named dust already

(cherry picked from commit ad126ee)

(cherry picked from commit 2685e45)

cc #79488

(cherry picked from commit cb5da4e)

cc #79488

(cherry picked from commit 630de55)

cc #79488

(cherry picked from commit ce34b92)

cc #79488