GitLab

Grafana has now moved to ffs05, hence disable for ffs03 to avoid the
renew getting stuck.

This is a role and not a collection

Switch the www-prod domain to the new www-prod container

Avoid having to specify "enabled: true" in every vhost, just default to
enabled.

This will for now only disable ssh password logins, when the variable
ssh_disable_password_login is set to yes.

This is currently completely untested.

When a user used to have root access but is then removed, we still left
the pubkey in place. Correctly handle this case by removing all pubkeys
of all users which don't have root access.

When a SSH key was lost or isn't used any more, we should be able to
remove it from all systems.

This can be done by specififing a new key revoked_pubkeys in a
user_database entry.

At the same time, revoke two keys of mine which are no longer in use.