- mediagoblin
    https://issues.mediagoblin.org/ticket/5455
    https://issues.mediagoblin.org/ticket/5441
- automate SSL with let's encrypt
    https://community.letsencrypt.org/t/howto-certificate-renewal-with-ansible/10214
- docs for postfix+dovecot let's encrypt setup
    https://ssl-tools.net/mailservers/
- nginx default config: gzip, sendfile, autoindex, etc
- email...
- unattended updates: maybe create new file instead of overwriting?
- mediagoblin required double-build to be successful?

- cgit
    => root-title, readme, root-desc, agefile
    => proper agefile based on commit date?

- prosody
- a workstation target? eg, with "my" package list
- gh-mirror (?)
- import old cruft/README from nsa commissioning repo
- review/refactor to ensure "copy" and "templates" are force=no when
  appropriate (user-modifiable stuff)
- cgit: front-page README ("about"), logo?