This factors out the functionality in nixos-install for running a
command inside a NixOS installation (nixos-install --chroot).

The use of Nix 2.0 significantly simplifies the installer, since we
can just pass a different store URI (--store /mnt) - it's no longer
needed to set up a chroot environment for the build, and to bootstrap
Nix into the chroot.

Also, commands that need to run in the installation (namely boot
loader installation and setting a root password) are now executed
using nixos-enter.

This also removes the need for nixos-prepare-root since any required
initialisation is done by Nix or by the activation script.

It requires the existence of /proc.

The activation script already does this.

...so it appears in a new installation before rebooting the system.

the new version brings a new panel in IPsec settings which allows to
reenable old algorithms for IPsec phases 1/2 (dropped in recent libreswan/strongswan etc).

Also updates the homepage with the new one.

l2tp saves its secrets into /etc/ipsec.d but strongswan would not read
them. l2tp checks for /etc/ipsec.secrets includes /etc/ipsec.d and if
not tries to write into it.

Solution:
Have the strongswan module create /etc/ipsec.d and /etc/ipsec.secrets
when networkmanager_l2tp is installed.
Include /etc/ipsec.secrets in
/nix/store/hash-strongswan/etc/ipsec.secrets so that it can find l2tp
secrets.

Also when the ppp 'nopeerdns' option is used, the DNS resolver tries to
write into an alternate file /etc/ppp/resolv.conf. This fails when
/etc/ppp does not exist so the module creates it by default.

The boot test now runs "nix verify" to ensure that all hashes are
correct.

E.g.

  nixos-install --root /tmp/mnt/ --no-bootloader --no-root-passwd

now works for non-root users.

This is already provided by devtmpfs.

Of course, you'll get a bunch of warnings from the activation script:

  $ nixos-enter --root /tmp/mnt/
  setting up /etc...
  mount: /dev: permission denied.
  mount: /dev/pts: permission denied.
  mount: /dev/shm: permission denied.
  mount: /sys: permission denied.
  /nix/var/nix/profiles/system/activate: line 74: /proc/sys/kernel/modprobe: Permission denied
  chown: changing ownership of '/run/wrappers/wrappers.0pKlU8JsvV/dbus-daemon-launch-helper': Invalid argument
  NOTE: Under Linux, effective file capabilities must either be empty, or
        exactly match the union of selected permitted and inheritable bits.
  Failed to set capabilities on file `/run/wrappers/wrappers.0pKlU8JsvV/ping' (Operation not permitted)
  chown: changing ownership of '/run/wrappers/wrappers.0pKlU8JsvV/unix_chkpwd': Invalid argument

  [root@nixos:/]#

This is useful in tests where we don't have network access. Passing
--substituters "" prevents wasting time by checking cache.nixos.org.

Since nixos-install doesn't require any special privileges anymore,
this Just Works. No more need for fakeroot / nixos-prepare-root.

This is no longer needed thanks to Nix 2.0 magic.

protocol really is a "buildPythonApplication" rather than a
buildPythonPackage".

gixy: 0.1.8 -> 0.1.9

riot-web: make package configurable