- registry: make --dh mandatory
- node: retry if the registry returns nothing (instead of writing an empty file)

I forgot the case where 'config' has slightly different schema.
Now, we don't have any old network left to upgrade.

The presence of /lib/systemd/system/*.service files masked the fact that the
/etc/init.d/ scripts were enabled, and services were not enabled under
systemd (no symlink in /etc/systemd/system/multi-user.target.wants/).

Reverting commit 4c2284e2 partially is the
easiest way to handle the case of OS upgrade (with a switch to systemd).

This fixes a regression caused by commit
  8df410f7

https://reproducible-builds.org/

Anyway, OpenVPN >= 2.3 was already missing on Squeeze, even via backports.

- Suse wants units in /usr/lib/systemd/system
- respect system-preset

debian/rules is split into reusable parts for SlapOS-based packages.

Unexpectedly, and contrary to 'dot', Graphviz does not draw it with penwidth=0
(without, that of the other side is striked). And anyway, we can just look at
the label to see if there's a route.

iproute now shows the name of the paired interface for type veth. For example:

  172: NETNSif-476f004@NETNSif-476f003: ...

When 10.42.3.1/24 was configured on 'lo', the kernel accepted packets to
any ip of 10.42.3.0/24, instead of only 10.42.3.1

The old distutils way is not compatible with zc.recipe.egg in develop mode,
because egg_info does not provide any information about such scripts.

2.2.x branch has a patch[1] that renders tls_serial_* environment variables
in base 16, causing a ValueError exception in ovpn-server hook.

[1] https://github.com/OpenVPN/openvpn/commit/7d5e26cbb53e2700c966e6b6e815f0c824da8956

It doesn't matter anymore if there are many off nodes, because the registry
only queries the addresses of nodes that are in the routing table.

This does not increase of any packet because the size of certificate signature
only depends on the size of the certificate key.

With 512-bit hashes, it's still possible to use RSA keys as small as 768 bits.

There is no plan for a default ipv4 route.

This is useful because the default one is not always the same as the route
to the registry.

Before, arrows were filled dot. Now only the default one is filled.

This simplify network configuration a lot, and on recent kernels, this fixes
wrong source address for extra interfaces that already have a public IP.