Working on and improving our Puppet environment while following best
practices [0] is currently blocking on our lack of an external node
classifier, or ENC. Adding this item as a priority on our roadmap will
resolve team#40358 and help advance team#29387

Deploying `hiera-enc` in itself should be fairly straightforward,
however since some nodes are assigned multiple roles, some of those
roles (eg. roles::fde) will have to be converted into profiles instead
and included from the role class. So a small amount of restructuring of
our roles manifests and current hiera data is to be expected.

If I can focus on this I don't expect it should take more than one
week's time (20h) to implement this fully.

[0] https://puppet.com/docs/puppet/7/the_roles_and_profiles_method.html

Following a discussion during the last S9 meeting, I was asked to draft
ideas for a workflow for editing the new Lektor blog that avoids using
the command-line and the `git` command.

Document the anticensorship team services

Closes tpo/anti-censorship/team#4

See merge request !15

The patches don't apply against the latest release and appear to be
rendered obsolete since the fixes have been merged upstream and
released.

Closes: tpo/anti-censorship/team#4

This makes us less dependent on alberti's name, but also could trigger
non-root SSH config rules, because it's not necessary here.

it's trivial, but if we don't say so, people might miss it...

At the time of writing, we have the following ways of creating a
filesystem in the wiki:

    anarcat@curie:help.torproject.org(master)$ git grep mkfs
    howto/ganeti.md:        mkfs /dev/vg_ganeti/srv-tmp &&
    howto/ganeti.md:        mkfs /dev/vg_ganeti/srv &&
    howto/lvm.md:    mkfs -t ext4 /dev/vg_ganeti/srv
    howto/new-machine-cymru.md:    mkfs.ext4 -j /dev/mapper/36782bcb00063c6a500000aa36036318d
    old/new-kvm-virsh-vm.md:mkfs.ext4 "$part1"
    service/ci.md:        mkfs -t ext4 -j /dev/sdc

Most of them use `-t ext4` instead of `.ext4`. I consider that to be
best practice, because it doesn't assume implementation
details (e.g. the existence of `mkfs.ext4`) in `mkfs`.

We especially do not, ever, use `-m` in the filesystem creation, let
alone with "zero percent". That feels like a bad idea in general: if
we run out of disk space, we have no emergency procedure to
recover. We should definitely avoid that: in some cases, we *may* want
to reduce the percentage from the default (5%) to something
smaller (say 1%, it even supports fractional percentages).

We should probably *always* use a journal as well, although by
default (in `mke2fs.conf`) the journal is enabled by
default (`has_journal`) is set, so it is really redundant nowadays.

address editor's feedback on dangerzone documentation

Closes team#40293

See merge request !14