reorder and regroup the (long) instance creation section

howto/ganeti.md

@@ -63,6 +63,8 @@ currently patched in our version of the Debian package, but that patch
 might disappear if Debian upgrade the package without [shipping our
 patch](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=944538).
 
+### What that does
+
 This configures the following:
 
  * redundant disks in a DRBD mirror, use `-t plain` instead of `-t drbd` for
@@ -81,15 +83,28 @@ This configures the following:
    of the instance, see below.
  * with the `test-01.torproject.org` hostname
 
+### Next steps
+
 To find the root password, ssh host key fingerprints, and the IPv6
 address, run this **on the node where the instance was created**, for
 example:
 
     egrep 'root password|configured eth0 with|SHA256' $(ls -tr /var/log/ganeti/os/* | tail -1) | grep -v $(hostname)
 
-Note that you need to use the `--node` parameter to pick on which
+We copy root's authorized keys into the new instance, so you should be able to
+log in with your token.  You will be required to change the root password immediately.
+Pick something nice and document it in `tor-passwords`.
+
+Also set reverse DNS for both IPv4 and IPv6 in [hetzner's robot](https://robot.your-server.de/).
+(Chek under servers -> vSwitch -> IPs)
+
+Then follow [howto/new-machine](howto/new-machine).
+
+### When the allocator fails
+
+Note that you may need to use the `--node` parameter to pick on which
 machines you want the machine to end up, otherwise Ganeti will choose
-for you. Use, for example, `--node fsn-node-01:fsn-node-02` to use
+for you (and may fail). Use, for example, `--node fsn-node-01:fsn-node-02` to use
 `node-01` as primary and `node-02` as secondary. It might be better to
 let the Ganeti allocator do its job since it will, eventually do this
 during cluster rebalancing. The allocator can sometimes fail if the
@@ -100,15 +115,6 @@ allocator is upset about something in the cluster, for example:
 This situation is covered by [ticket 33785](https://bugs.torproject.org/33785). If this problem
 occurs, it might be worth [rebalancing the cluster](#Rebalancing-a-cluster).
 
-We copy root's authorized keys into the new instance, so you should be able to
-log in with your token.  You will be required to change the root password immediately.
-Pick something nice and document it in `tor-passwords`.
-
-Also set reverse DNS for both IPv4 and IPv6 in [hetzner's robot](https://robot.your-server.de/).
-(Chek under servers -> vSwitch -> IPs)
-
-Then follow [howto/new-machine](howto/new-machine).
-
 ## Modifying an instance
 
 ### CPU, memory changes