From: Matt Birkholz <matt@birchwood-abbey.net>
Date: Thu, 14 May 2026 20:49:32 +0000 (-0600)
Subject: Tangled blocks are now separated by blank lines(?).
X-Git-Url: https://birchwood-abbey.net/git?a=commitdiff_plain;h=86f8fad0a6c39194b7e26d758732e181d1be37e3;p=Institute

Tangled blocks are now separated by blank lines(?).
---

diff --git a/README.org b/README.org
index 394bbf0..ab0ef6f 100644
--- a/README.org
+++ b/README.org
@@ -727,7 +727,6 @@ configuration using mostly-default VirtualBoxes (described [[*Testing][here]]).
 
 #+CAPTION: [[file:private/vars.yml][=private/vars.yml=]]
 #+BEGIN_SRC conf :tangle private/vars.yml
-
 private_net_cidr:           192.168.56.0/24
 wild_net_cidr:              192.168.57.0/24
 public_wg_net_cidr:         10.177.87.0/24
@@ -797,7 +796,6 @@ with ~address-vars~ in the =default/main.yml= files.
 #+NAME: address-vars
 #+CAPTION: ~address-vars~
 #+BEGIN_SRC conf
-
 core_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('1') }}"
 gate_addr_cidr:  "{{ private_net_cidr | ansible.utils.ipaddr('2') }}"
 gate_wild_addr_cidr:
@@ -1289,7 +1287,6 @@ follows these recommendations (and /not/ the suggestion to enable
 
 #+CAPTION: [[file:roles_t/all/tasks/main.yml][=roles_t/all/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/all/tasks/main.yml
-
 - name: Install systemd-resolved.
   become: yes
   apt: pkg=systemd-resolved
@@ -1344,7 +1341,6 @@ X.509 certificates is available in [[*Keys][Keys]].
 
 #+CAPTION: [[file:roles_t/all/tasks/main.yml][=roles_t/all/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/all/tasks/main.yml
-
 - name: Trust the institute CA.
   become: yes
   copy:
@@ -1392,7 +1388,9 @@ The ~front~ role sets a number of variables to default values in its
 #+BEGIN_SRC conf :tangle roles_t/front/defaults/main.yml :noweb no-export :mkdirp yes
 ---
 <<network-vars>>
+
 <<address-vars>>
+
 <<membership-rolls>>
 #+END_SRC
 
@@ -1428,7 +1426,6 @@ delivery.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Configure hostname.
   become: yes
   copy:
@@ -1453,7 +1450,6 @@ these groups speeds up debugging.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
@@ -1475,7 +1471,6 @@ key on Core.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Create monkey.
   become: yes
   user:
@@ -1503,7 +1498,6 @@ Monkey uses Rsync to keep the institute's public web site up-to-date.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Install rsync.
   become: yes
   apt: pkg=rsync
@@ -1515,7 +1509,6 @@ The institute prefers to install security updates as soon as possible.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
@@ -1530,7 +1523,6 @@ recipient" replies.  The [[*Account Management][Account Management]] chapter des
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Create user accounts.
   become: yes
   user:
@@ -1569,7 +1561,6 @@ and =/etc/server.key= files, the latter only readable by ~root~.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Install server certificate/key.
   become: yes
   copy:
@@ -1682,7 +1673,6 @@ start and enable the service.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
 - name: Install Postfix.
   become: yes
   apt: pkg=postfix
@@ -1769,7 +1759,6 @@ created by a more specialized role.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: New aliases.
   become: yes
   command: newaliases
@@ -1784,7 +1773,6 @@ OpenDKIM, and Postfix.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
 - name: Install OpenDKIM.
   become: yes
   apt: pkg=opendkim
@@ -1863,7 +1851,6 @@ OpenDKIM, and Postfix.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Restart OpenDKIM.
   become: yes
   systemd:
@@ -1895,7 +1882,6 @@ and enables it to start at every reboot.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
 - name: Install Dovecot IMAPd.
   become: yes
   apt: pkg=dovecot-imapd
@@ -1946,7 +1932,6 @@ and enables it to start at every reboot.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Restart Dovecot.
   become: yes
   systemd:
@@ -2104,7 +2089,6 @@ e.g. =/etc/apache2/sites-available/small.example.org.conf= and runs
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
 - name: Install Apache2.
   become: yes
   apt: pkg=apache2
@@ -2155,7 +2139,6 @@ e.g. =/etc/apache2/sites-available/small.example.org.conf= and runs
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Restart Apache2.
   become: yes
   systemd:
@@ -2169,7 +2152,6 @@ that it does not interfere with its replacement.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Disable default vhosts.
   become: yes
   file:
@@ -2185,7 +2167,6 @@ same records as =access.log=.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Disable other-vhosts-access-log option.
   become: yes
   file:
@@ -2199,7 +2180,6 @@ the users' =~/Public/HTML/= directories.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Create UserDir.
   become: yes
   file:
@@ -2240,7 +2220,6 @@ not exist), and enable the service.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Enable IP forwarding.
   become: yes
   copy:
@@ -2283,7 +2262,6 @@ not exist), and enable the service.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Reload sysctl.
   become: yes
   systemd:
@@ -2403,7 +2381,6 @@ The first step is to install Kamailio.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Install Kamailio.
   become: yes
   apt: pkg=kamailio
@@ -2416,7 +2393,6 @@ not be started before the ~wg0~ device has appeared.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml
-
 - name: Create Kamailio/Systemd configuration drop.
   become: yes
   file:
@@ -2436,7 +2412,6 @@ not be started before the ~wg0~ device has appeared.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Reload Systemd.
   become: yes
   systemd:
@@ -2447,7 +2422,6 @@ Finally, Kamailio can be configured and started.
 
 #+CAPTION: [[file:roles_t/front/tasks/main.yml][=roles_t/front/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/tasks/main.yml :noweb no-export
-
 - name: Configure Kamailio.
   become: yes
   copy:
@@ -2472,7 +2446,6 @@ Finally, Kamailio can be configured and started.
 
 #+CAPTION: [[file:roles_t/front/handlers/main.yml][=roles_t/front/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/front/handlers/main.yml
-
 - name: Restart Kamailio.
   become: yes
   systemd:
@@ -2499,7 +2472,9 @@ default values in its =defaults/main.yml= file.
 #+BEGIN_SRC conf :tangle roles_t/core/defaults/main.yml :noweb no-export :mkdirp yes
 ---
 <<network-vars>>
+
 <<address-vars>>
+
 <<membership-rolls>>
 #+END_SRC
 
@@ -2534,7 +2509,6 @@ proper email delivery.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure hostname.
   become: yes
   copy:
@@ -2559,7 +2533,6 @@ list, and to disable its cache and stub listener.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure resolved.
   become: yes
   lineinfile:
@@ -2621,7 +2594,6 @@ core_lan_mac:               08:00:27:b3:e5:5f
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install 10-lan.link.
   become: yes
   copy:
@@ -2652,7 +2624,6 @@ core_lan_mac:               08:00:27:b3:e5:5f
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Reload networkd.
   become: yes
   command: networkctl reload
@@ -2709,7 +2680,6 @@ the real [[file:private/core-dhcpd.conf][=private/core-dhcpd.conf=]] (/not/ the
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install DHCP server.
   become: yes
   apt: pkg=isc-dhcp-server
@@ -2745,7 +2715,6 @@ the real [[file:private/core-dhcpd.conf][=private/core-dhcpd.conf=]] (/not/ the
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Restart DHCP server.
   become: yes
   systemd:
@@ -2764,7 +2733,6 @@ The following tasks install and configure BIND9 on Core.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
 - name: Install BIND9.
   become: yes
   apt: pkg=bind9
@@ -2809,7 +2777,6 @@ The following tasks install and configure BIND9 on Core.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
   - name: Reload BIND9.
     become: yes
     systemd:
@@ -2975,7 +2942,6 @@ these groups speeds up debugging.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
@@ -2994,7 +2960,6 @@ described in [[apache2-core][*Configure Apache2]]).
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Create monkey.
   become: yes
   user:
@@ -3052,7 +3017,6 @@ The institute prefers to install security updates as soon as possible.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
@@ -3066,7 +3030,6 @@ describes the ~members~ and ~usernames~ variables.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Create user accounts.
   become: yes
   user:
@@ -3105,7 +3068,6 @@ to institute clients.  They share the =/etc/server.crt= and
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install server certificate/key.
   become: yes
   copy:
@@ -3131,7 +3093,6 @@ The default daemon's default configuration is fine.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install Chrony.
   become: yes
   apt: pkg=chrony
@@ -3149,7 +3110,6 @@ The default daemon's default configuration is fine.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Restart Chrony.
   become: yes
   systemd:
@@ -3234,7 +3194,6 @@ enable the service.  Whenever =/etc/postfix/transport= is changed, the
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
 - name: Install Postfix.
   become: yes
   apt: pkg=postfix
@@ -3274,7 +3233,6 @@ enable the service.  Whenever =/etc/postfix/transport= is changed, the
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Restart Postfix.
   become: yes
   systemd:
@@ -3301,7 +3259,6 @@ installed by more specialized roles.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install institute email aliases.
   become: yes
   blockinfile:
@@ -3317,7 +3274,6 @@ installed by more specialized roles.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: New aliases.
   become: yes
   command: newaliases
@@ -3347,7 +3303,6 @@ and enables it to start at every reboot.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
 - name: Install Dovecot IMAPd.
   become: yes
   apt: pkg=dovecot-imapd
@@ -3396,7 +3351,6 @@ and enables it to start at every reboot.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Restart Dovecot.
   become: yes
   systemd:
@@ -3464,7 +3418,6 @@ provided the Core service.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
 - name: Install fetchmail.
   become: yes
   apt: pkg=fetchmail
@@ -3516,7 +3469,6 @@ stopped and disabled from restarting at boot, deleted even.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Stop former user fetchmail services.
   become: yes
   systemd:
@@ -3535,7 +3487,6 @@ If the =.service= file is deleted, then Ansible cannot use the
 Otherwise the following task might be appropriate.
 
 #+BEGIN_SRC conf
-
 - name: Delete former user fetchmail services.
   become: yes
   file:
@@ -3675,7 +3626,6 @@ The tasks below install Apache2 and edit its default configuration.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install Apache2.
   become: yes
   apt: pkg=apache2
@@ -3706,7 +3656,6 @@ The ~a2ensite~ command enables them.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml :noweb no-export
-
 - name: Install live web site.
   become: yes
   copy:
@@ -3758,7 +3707,6 @@ The ~a2ensite~ command enables them.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Restart Apache2.
   become: yes
   systemd:
@@ -3796,7 +3744,6 @@ provided [[webupdate][here]].
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: "Install Monkey's webupdate script."
   become: yes
   copy:
@@ -3827,7 +3774,6 @@ service.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Enable IP forwarding.
   become: yes
   copy:
@@ -3875,7 +3821,6 @@ service.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Reload sysctl.
   become: yes
   systemd:
@@ -3906,7 +3851,6 @@ Core and Campus (and thus Gate) machines.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install NAGIOS4.
   become: yes
   apt:
@@ -3966,7 +3910,6 @@ Core and Campus (and thus Gate) machines.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Reload NAGIOS4.
   become: yes
   systemd:
@@ -4140,7 +4083,6 @@ Core.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define command {
     command_name            inst_sensors
     command_line            /usr/local/sbin/inst_sensors
@@ -4177,7 +4119,6 @@ pings.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define host {
     use                     linux-server
     host_name               gate
@@ -4197,7 +4138,6 @@ Monitor ~inst_root~ on Gate.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define service {
     use                     generic-service
     host_name               gate
@@ -4210,7 +4150,6 @@ Monitor ~check_load~ on Gate.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define service {
     use                     generic-service
     host_name               gate
@@ -4223,7 +4162,6 @@ Monitor ~check_zombie_procs~ and ~check_total_procs~ on Gate.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define service {
     use                     generic-service
     host_name               gate
@@ -4251,7 +4189,6 @@ Monitor ~inst_swap~ on Gate.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define service {
     use                     generic-service
     host_name               gate
@@ -4272,7 +4209,6 @@ Monitor ~inst_sensors~ on Gate.
 
 #+CAPTION: [[file:roles_t/core/templates/nagios.cfg][=roles_t/core/templates/nagios.cfg=]]
 #+BEGIN_SRC conf :tangle roles_t/core/templates/nagios.cfg
-
 define service {
     use                     generic-service
     host_name               gate
@@ -4288,7 +4224,6 @@ example script is provided in [[backup][here]].
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install backup script.
   become: yes
   copy:
@@ -4314,7 +4249,6 @@ installing a cron job.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install packages required by Nextcloud.
   become: yes
   apt:
@@ -4328,7 +4262,6 @@ Next, a number of Apache2 modules are enabled.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Enable Apache2 modules for Nextcloud.
   become: yes
   apache2_module:
@@ -4359,7 +4292,6 @@ Alias /nextcloud "/var/www/nextcloud/"
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install Nextcloud web configuration.
   become: yes
   copy:
@@ -4382,7 +4314,6 @@ virtual host's document root.
 
 #+CAPTION: [[file:roles_t/core/files/nextcloud.conf][=roles_t/core/files/nextcloud.conf=]]
 #+BEGIN_SRC conf :tangle roles_t/core/files/nextcloud.conf
-
 <Directory /var/www/html/>
     <IfModule mod_rewrite.c>
 	RewriteEngine on
@@ -4406,7 +4337,6 @@ page.  The following portion of =nextcloud.conf= sets a
 
 #+CAPTION: [[file:roles_t/core/files/nextcloud.conf][=roles_t/core/files/nextcloud.conf=]]
 #+BEGIN_SRC conf :tangle roles_t/core/files/nextcloud.conf
-
 <IfModule mod_headers.c>
     Header always set \
 	Strict-Transport-Security "max-age=15552000; includeSubDomains"
@@ -4420,7 +4350,6 @@ cloud FUBARs.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Add {{ ansible_user }} to web server group.
   become: yes
   user:
@@ -4434,7 +4363,6 @@ jobs.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Create Nextcloud cron job.
   become: yes
   cron:
@@ -4460,7 +4388,6 @@ When the ~mysql_db~ Ansible module supports ~check_implicit_admin~,
 the following task can create Nextcloud's DB.
 
 #+BEGIN_SRC conf
-
 - name: Create Nextcloud DB.
   become: yes
   mysql_db:
@@ -4476,7 +4403,6 @@ such a user, the ~nextcloud~ database and ~nextclouduser~ user are
 created manually.
 
 #+BEGIN_SRC conf
-
 - name: Create Nextcloud DB user.
   become: yes
   mysql_user:
@@ -4512,7 +4438,6 @@ its document root.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Link /var/www/nextcloud.
   become: yes
   file:
@@ -4530,7 +4455,6 @@ performance, as recommended by Nextcloud.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Set PHP memory_limit for Nextcloud.
   become: yes
   lineinfile:
@@ -4729,7 +4653,6 @@ afterwards tasks causes them to skip rather than fail.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Test for /Nextcloud/nextcloud/.
   stat:
     path: /Nextcloud/nextcloud
@@ -4756,7 +4679,6 @@ Pretty URLs (below).
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure Nextcloud trusted domains.
   become: yes
   replace:
@@ -4786,7 +4708,6 @@ enables it.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure Nextcloud memcache.
   become: yes
   lineinfile:
@@ -4806,7 +4727,6 @@ and ~htaccess.RewriteBase~.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure Nextcloud for Pretty URLs.
   become: yes
   lineinfile:
@@ -4846,7 +4766,6 @@ unedited copy of the parameters SMTP and /not/ by Sendmail nor Qmail.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Configure Nextcloud settings.
   become: yes
   lineinfile:
@@ -4880,7 +4799,6 @@ run before the next backup.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Create /Nextcloud/dbbackup.cnf.
   no_log: yes
   become: yes
@@ -4936,6 +4854,7 @@ default values in its =defaults/main.yml= file.
 #+BEGIN_SRC conf :tangle roles_t/gate/defaults/main.yml :noweb no-export :mkdirp yes
 ---
 <<network-vars>>
+
 <<address-vars>>
 #+END_SRC
 
@@ -4981,7 +4900,6 @@ The campus Ethernet interface is named ~lan~ and configured by
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
 - name: Install 10-lan.link.
   become: yes
   copy:
@@ -5051,7 +4969,6 @@ configured by =10-wild.link= and =10-wild.network= files in
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
 - name: Install 10-wild.link.
   become: yes
   copy:
@@ -5102,7 +5019,6 @@ tether, Wi-Fi connection, etc.
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
 - name: Install 10-isp.link.
   become: yes
   copy:
@@ -5185,7 +5101,6 @@ listener" listen there.  That stub should not read =/etc/hosts= lest
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
 - name: Configure resolved.
   become: yes
   lineinfile:
@@ -5204,7 +5119,6 @@ listener" listen there.  That stub should not read =/etc/hosts= lest
 
 #+CAPTION: [[file:roles_t/gate/handlers/main.yml][=roles_t/gate/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/handlers/main.yml
-
 - name: Reload Systemd.
   become: yes
   systemd:
@@ -5290,7 +5204,6 @@ policy in =/etc/default/ufw=, and install the institute's rules in
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml :noweb no-export
-
 - name: Install UFW.
   become: yes
   apt: pkg=ufw
@@ -5346,7 +5259,6 @@ not exist), and enable the service.
 
 #+CAPTION: [[file:roles_t/gate/tasks/main.yml][=roles_t/gate/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/tasks/main.yml
-
 - name: Enable IP forwarding.
   become: yes
   copy:
@@ -5389,7 +5301,6 @@ not exist), and enable the service.
 
 #+CAPTION: [[file:roles_t/gate/handlers/main.yml][=roles_t/gate/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/gate/handlers/main.yml
-
 - name: Reload sysctl.
   become: yes
   systemd:
@@ -5512,6 +5423,7 @@ default values in its =defaults/main.yml= file.
 #+BEGIN_SRC conf :tangle roles_t/campus/defaults/main.yml :noweb no-export :mkdirp yes
 ---
 <<network-vars>>
+
 <<address-vars>>
 #+END_SRC
 
@@ -5535,7 +5447,6 @@ Clients should be using the expected host name.
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Configure hostname.
   become: yes
   copy:
@@ -5562,7 +5473,6 @@ and file timestamps.
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Install timesyncd.
   become: yes
   apt: pkg=systemd-timesyncd
@@ -5608,7 +5518,6 @@ these groups speeds up debugging.
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Add {{ ansible_user }} to system groups.
   become: yes
   user:
@@ -5623,7 +5532,6 @@ The institute prefers to install security updates as soon as possible.
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Install basic software.
   become: yes
   apt: pkg=unattended-upgrades
@@ -5643,7 +5551,6 @@ tasks below.
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml :noweb no-export
-
 - name: Install Postfix.
   become: yes
   apt: pkg=postfix
@@ -5683,7 +5590,6 @@ tasks below.
 
 #+CAPTION: [[file:roles_t/campus/handlers/main.yml][=roles_t/campus/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/handlers/main.yml
-
 - name: Restart Postfix.
   become: yes
   systemd:
@@ -5701,7 +5607,6 @@ manpage.)
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Set domain name.
   become: yes
   vars:
@@ -5721,7 +5626,6 @@ Role]].
 
 #+CAPTION: [[file:roles_t/campus/tasks/main.yml][=roles_t/campus/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/tasks/main.yml
-
 - name: Install NRPE.
   become: yes
   apt:
@@ -5765,7 +5669,6 @@ Role]].
 
 #+CAPTION: [[file:roles_t/campus/handlers/main.yml][=roles_t/campus/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/campus/handlers/main.yml
-
 - name: Reload NRPE server.
   become: yes
   systemd:
@@ -6054,7 +5957,6 @@ permissions.  It probes past the [[file:Secret/][=Secret/=]] mount point (probin
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 sub note_missing_file_p ($);
 sub note_missing_directory_p ($);
 
@@ -6111,7 +6013,6 @@ them.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC conf :tangle inst
-
 sub mysystem (@) {
   my $line = join (" ", @_);
   print "$line\n";
@@ -6149,6 +6050,7 @@ just a playbook because it needs a copy of the role defaults.
 #+BEGIN_SRC conf :tangle roles_t/check-inst-vars/defaults/main.yml :noweb no-export :mkdirp yes
 ---
 <<network-vars>>
+
 <<address-vars>>
 #+END_SRC
 
@@ -6234,7 +6136,6 @@ that will be installed on their servers by the next ~./inst config~.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 if (defined $ARGV[0] && $ARGV[0] eq "CA") {
   die "usage: $0 CA" if @ARGV != 1;
   die "Secret/CA/easyrsa: not an executable\n"
@@ -6310,7 +6211,6 @@ Example command lines:
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 if (defined $ARGV[0] && $ARGV[0] eq "config") {
   die "Secret/CA/easyrsa: not executable\n"
     if ! -x "Secret/CA/easyrsa";
@@ -6400,7 +6300,6 @@ value of ~membership_rolls~.
 #+NAME: membership-rolls
 #+CAPTION: ~membership-rolls~
 #+BEGIN_SRC conf
-
 membership_rolls:
 - "../private/members.yml"
 - "../private/members-empty.yml"
@@ -6420,7 +6319,6 @@ read from the file.  The dump subroutine is another story (below).
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 use YAML::XS qw(LoadFile DumpFile);
 
 sub read_members_yaml () {
@@ -6494,7 +6392,6 @@ each record.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 sub print_member ($$$) {
   my ($out, $username, $member) = @_;
   print $out "  ", $username, ":\n";
@@ -6541,7 +6438,6 @@ initial, generated password.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 sub valid_username (@);
 sub shell_escape ($);
 sub strip_vault ($);
@@ -6728,7 +6624,6 @@ the administrator to update =private/members.yml= before running
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 use MIME::Base64;
 sub write_wireguard ($);
 
@@ -6814,7 +6709,6 @@ configuration so that the email to root can be encrypted.
 
 #+CAPTION: [[file:roles_t/core/tasks/main.yml][=roles_t/core/tasks/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/tasks/main.yml
-
 - name: Install institute passwd command.
   become: yes
   template:
@@ -6860,7 +6754,6 @@ configuration so that the email to root can be encrypted.
 
 #+CAPTION: [[file:roles_t/core/handlers/main.yml][=roles_t/core/handlers/main.yml=]]
 #+BEGIN_SRC conf :tangle roles_t/core/handlers/main.yml
-
 - name: Import root PGP key.
   become: no
   command: gpg --import /etc/root-pub.pem
@@ -6872,7 +6765,6 @@ The ~old~ command disables a member's account (and thus their clients).
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 if (defined $ARGV[0] && $ARGV[0] eq "old") {
   my $user = valid_username (@ARGV);
   my $yaml = read_members_yaml ();
@@ -7168,7 +7060,6 @@ above.
 
 #+CAPTION: [[file:inst][=inst=]]
 #+BEGIN_SRC perl :tangle inst
-
 die "usage: $0 [CA|config|new|pass|old|client] ...\n";
 #+END_SRC
 
@@ -7471,7 +7362,6 @@ Ansible's public SSH key.
 
 #+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
 #+BEGIN_SRC sh :tangle private/test-front-prep :noweb no-export
-
 ( umask 377
   echo "AJkzVxfTm/KvRjzTN/9X2jYy+CAugiwZfN5F3JTegms=" \
   | sudo tee /etc/wireguard/private-key >/dev/null )
@@ -7492,7 +7382,6 @@ to the second NIC.
 
 #+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
 #+BEGIN_SRC sh :tangle private/test-front-prep :tangle-mode u=rwx,g=,o=
-
 ( cd /etc/network/; \
   [ -f interfaces~ ] || sudo mv interfaces interfaces~ )
 cat <<EOF | sudo tee /etc/network/interfaces >/dev/null
@@ -7526,7 +7415,6 @@ identities).
 
 #+CAPTION: [[file:private/test-front-prep][=private/test-front-prep=]]
 #+BEGIN_SRC sh :tangle private/test-front-prep
-
 ( cd front_ssh/; sudo cp -b ssh_host_* /etc/ssh/ )
 #+END_SRC
 
@@ -7601,7 +7489,6 @@ sufficient to allow remote access by Ansible.)
 
 #+CAPTION: [[file:private/test-gate-prep][=private/test-gate-prep=]]
 #+BEGIN_SRC sh :tangle private/test-gate-prep
-
 cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
 [Match]
 MACAddress=08:00:27:f3:16:79
@@ -7710,7 +7597,6 @@ Next, the script configures the primary NIC with =10-lan.link= and
 
 #+CAPTION: [[file:private/test-core-prep][=private/test-core-prep=]]
 #+BEGIN_SRC sh :tangle private/test-core-prep
-
 cat <<EOD | sudo tee /etc/systemd/network/10-lan.link >/dev/null
 [Match]
 MACAddress=08:00:27:b3:e5:5f