Add ansible_managed token to templates

19 files changed, 34 insertions, 687 deletions

diff --git a/README.org b/README.org
index b94fc13..66d61ff 100644
--- a/README.org
+++ b/README.org
@@ -53,12 +53,17 @@ https://stackoverflow.com/questions/24738264/how-to-test-ansible-playbook-using-
 * Pad
 ** Production
 ansible-playbook -i inventory.yml prod-playbook.yml --tags pad,proxy
+
 To fall back to wikimedia rewrite:
-ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy -e "use_wikimedia=true"
+ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy --extra-vars='{"use_wikimedia": true}'
 You can still access pads directly with direct/p like this:
-http://pad.emacsconf.org/direct/p/2022-journalism
+https://pad.emacsconf.org/direct/p/2022-journalism
+
 To undo wikimedia rewrite:
-ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy -e "use_wikimedia=false"
+ansible-playbook -i inventory.yml prod-playbook.yml --tags proxy 
+
+To prepare for a load test:
+ansible-playbook -i inventory.yml prod-playbook.yml --tags pad --extra-vars='{"etherpad_load_test": true}'
 
 ** Docker
 Creating:
diff --git a/ansible.cfg b/ansible.cfg
new file mode 100644
index 0000000..9e9fd55
--- /dev/null
+++ b/ansible.cfg
@@ -0,0 +1,2 @@
+[defaults]
+ansible_managed = This file is managed by Ansible. Please make sure your changes are reflected in git@git.emacsconf.org:pub/emacsconf-ansible .
\ No newline at end of file
diff --git a/roles/pad-proxy/tasks/main.yml b/roles/pad-proxy/tasks/main.yml
index 8de72df..b8cfdf3 100644
--- a/roles/pad-proxy/tasks/main.yml
+++ b/roles/pad-proxy/tasks/main.yml
@@ -6,6 +6,9 @@
     apt:
       name: nginx
       state: present
+  - debug:
+      var: ansible_managed
+    tags: wip
   - name: Add proxy configuration
     template:
       src: etherpad.nginx.conf
diff --git a/roles/pad-proxy/templates/etherpad.nginx.conf b/roles/pad-proxy/templates/etherpad.nginx.conf
index 90a7c1c..95838be 100644
--- a/roles/pad-proxy/templates/etherpad.nginx.conf
+++ b/roles/pad-proxy/templates/etherpad.nginx.conf
@@ -1,3 +1,5 @@
+# {{ ansible_managed }}
+
 upstream etherpad_upstream {
 	server 127.0.0.1:9001;
 }
diff --git a/roles/pad-proxy/templates/wikimedia.etherpad.nginx.conf b/roles/pad-proxy/templates/wikimedia.etherpad.nginx.conf
deleted file mode 100644
index 2288c65..0000000
--- a/roles/pad-proxy/templates/wikimedia.etherpad.nginx.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-upstream etherpad_upstream {
-	server 127.0.0.1:9001;
-}
-server {
-  listen 80;
-  server_name {{ etherpad_server_name }};
-  access_log  /var/log/nginx/{{ etherpad_server_name }}.access.log;
-  location /p/ {
-    rewrite ^/p/(.*) /$1 redirect;
-  }
-  location ~ ^/$ {
-    return 302 https://etherpad.wikimedia.org/p/emacsconf-2022;
-  }
-  location ~ ^/(locales/|locales.json|admin/|static/|pluginfw/|javascripts/|socket.io/|ep/|minified/|api/|ro/|error/|jserror/|favicon.ico|robots.txt) {
-    proxy_buffering off;
-    proxy_pass http://etherpad_upstream;
-  }
-  location ~ ^/pad-lister($|\/.*) {
-    proxy_buffering off;
-    proxy_pass http://etherpad_upstream;
-  }
-  location /direct/ {
-    rewrite /direct/(.*) /$1 break;
-    proxy_set_header        Host $host;
-    proxy_set_header        X-Real-IP $remote_addr;
-    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header        X-Forwarded-Proto $scheme;
-    proxy_pass http://etherpad_upstream/p/;
-  }
-  location / {
-    rewrite /(.*) https://etherpad.wikimedia.org/p/emacsconf-$1 redirect;
-  }
-}
diff --git a/roles/pad/defaults/main.yml b/roles/pad/defaults/main.yml
index 9d2e294..2d54195 100644
--- a/roles/pad/defaults/main.yml
+++ b/roles/pad/defaults/main.yml
@@ -7,3 +7,4 @@ etherpad_user: etherpad
 etherpad_group: etherpad
 etherpad_base: emacsconf
 etherpad_year: 2022
+etherpad_load_test: false
diff --git a/roles/pad/tasks/loadtest.yml b/roles/pad/tasks/loadtest.yml
deleted file mode 100644
index 28deefc..0000000
--- a/roles/pad/tasks/loadtest.yml
+++ /dev/null
@@ -1,11 +0,0 @@
----
-- name: Install loadtest configuration
-  become: true
-  template:
-    src: loadtest.settings.json
-    dest: "{{ etherpad_path }}/settings.json"
-- name: Restart Etherpad
-  become: true
-  service:
-    name: etherpad
-    state: restarted
diff --git a/roles/pad/tasks/main.yml b/roles/pad/tasks/main.yml
index 01b2da7..7d71f59 100644
--- a/roles/pad/tasks/main.yml
+++ b/roles/pad/tasks/main.yml
@@ -115,6 +115,3 @@
   uri:
     url: "http://localhost:9001/api/1/createPad?apikey={{ etherpad_api_key }}&padID={{etherpad_year}}-{{ item.slug }}"
   loop: "{{ talks | json_query('talks[*]') }}"
-- include: loadtest.yml
-  become: true
-  when: load_test is defined
diff --git a/roles/pad/templates/etherpad.init.d b/roles/pad/templates/etherpad.init.d
index 420ae27..299d5fb 100755
--- a/roles/pad/templates/etherpad.init.d
+++ b/roles/pad/templates/etherpad.init.d
@@ -1,4 +1,5 @@
 #!/bin/sh
+# {{ ansible_managed }}
 
 ### BEGIN INIT INFO
 # Provides:          etherpad-lite
@@ -76,4 +77,4 @@ case "$1" in
 	  ;;
 esac
 
-exit 0
\ No newline at end of file
+exit 0
diff --git a/roles/pad/templates/etherpad.service b/roles/pad/templates/etherpad.service
index f8e947d..bcc45d1 100644
--- a/roles/pad/templates/etherpad.service
+++ b/roles/pad/templates/etherpad.service
@@ -1,3 +1,5 @@
+# {{ ansible_managed }}
+
 [Unit]
 Description=Etherpad
 After=syslog.target network.target
diff --git a/roles/pad/templates/loadtest.settings.json b/roles/pad/templates/loadtest.settings.json
deleted file mode 100644
index 4e64cba..0000000
--- a/roles/pad/templates/loadtest.settings.json
+++ /dev/null
@@ -1,632 +0,0 @@
-/*
- * This file must be valid JSON. But comments are allowed
- *
- * Please edit settings.json, not settings.json.template
- *
- * Please note that starting from Etherpad 1.6.0 you can store DB credentials in
- * a separate file (credentials.json).
- *
- *
- * ENVIRONMENT VARIABLE SUBSTITUTION
- * =================================
- *
- * All the configuration values can be read from environment variables using the
- * syntax "${ENV_VAR}" or "${ENV_VAR:default_value}".
- *
- * This is useful, for example, when running in a Docker container.
- *
- * DETAILED RULES:
- *   - If the environment variable is set to the string "true" or "false", the
- *     value becomes Boolean true or false.
- *   - If the environment variable is set to the string "null", the value
- *     becomes null.
- *   - If the environment variable is set to the string "undefined", the setting
- *     is removed entirely, except when used as the member of an array in which
- *     case it becomes null.
- *   - If the environment variable is set to a string representation of a finite
- *     number, the string is converted to that number.
- *   - If the environment variable is set to any other string, including the
- *     empty string, the value is that string.
- *   - If the environment variable is unset and a default value is provided, the
- *     value is as if the environment variable was set to the provided default:
- *       - "${UNSET_VAR:}" becomes the empty string.
- *       - "${UNSET_VAR:foo}" becomes the string "foo".
- *       - "${UNSET_VAR:true}" and "${UNSET_VAR:false}" become true and false.
- *       - "${UNSET_VAR:null}" becomes null.
- *       - "${UNSET_VAR:undefined}" causes the setting to be removed (or be set
- *         to null, if used as a member of an array).
- *   - If the environment variable is unset and no default value is provided,
- *     the value becomes null. THIS BEHAVIOR MAY CHANGE IN A FUTURE VERSION OF
- *     ETHERPAD; if you want the default value to be null, you should explicitly
- *     specify "null" as the default value.
- *
- * EXAMPLE:
- *    "port":     "${PORT:9001}"
- *    "minify":   "${MINIFY}"
- *    "skinName": "${SKIN_NAME:colibris}"
- *
- * Would read the configuration values for those items from the environment
- * variables PORT, MINIFY and SKIN_NAME.
- *
- * If PORT and SKIN_NAME variables were not defined, the default values 9001 and
- * "colibris" would be used.
- * The configuration value "minify", on the other hand, does not have a
- * designated default value. Thus, if the environment variable MINIFY were
- * undefined, "minify" would be null.
- *
- * REMARKS:
- * 1) please note that variable substitution always needs to be quoted.
- *
- *    "port":     9001,            <-- Literal values. When not using
- *    "minify":   false                substitution, only strings must be
- *    "skinName": "colibris"           quoted. Booleans and numbers must not.
- *
- *    "port":     "${PORT:9001}"   <-- CORRECT: if you want to use a variable
- *    "minify":   "${MINIFY:true}"     substitution, put quotes around its name,
- *    "skinName": "${SKIN_NAME}"       even if the required value is a number or
- *                                     a boolean.
- *                                     Etherpad will take care of rewriting it
- *                                     to the proper type if necessary.
- *
- *    "port":     ${PORT:9001}     <-- ERROR: this is not valid json. Quotes
- *    "minify":   ${MINIFY}            around variable names are missing.
- *    "skinName": ${SKIN_NAME}
- *
- * 2) Beware of undefined variables and default values: nulls and empty strings
- *    are different!
- *
- *    This is particularly important for user's passwords (see the relevant
- *    section):
- *
- *    "password": "${PASSW}"  // if PASSW is not defined would result in password === null
- *    "password": "${PASSW:}" // if PASSW is not defined would result in password === ''
- *
- *    If you want to use an empty value (null) as default value for a variable,
- *    simply do not set it, without putting any colons: "${ABIWORD}".
- *
- * 3) if you want to use newlines in the default value of a string parameter,
- *    use "\n" as usual.
- *
- *    "defaultPadText" : "${DEFAULT_PAD_TEXT}Line 1\nLine 2"
- */
-{
-  /*
-   * Name your instance!
-   */
-  "title": "EmacsConf Etherpad",
-
-  /*
-   * Pathname of the favicon you want to use. If null, the skin's favicon is
-   * used if one is provided by the skin, otherwise the default Etherpad favicon
-   * is used. If this is a relative path it is interpreted as relative to the
-   * Etherpad root directory.
-   */
-  "favicon": null,
-
-  /*
-   * Skin name.
-   *
-   * Its value has to be an existing directory under src/static/skins.
-   * You can write your own, or use one of the included ones:
-   *
-   * - "no-skin":  an empty skin (default). This yields the unmodified,
-   *               traditional Etherpad theme.
-   * - "colibris": the new experimental skin (since Etherpad 1.8), candidate to
-   *               become the default in Etherpad 2.0
-   */
-  "skinName": "colibris",
-
-  /*
-   * Skin Variants
-   *
-   * Use the UI skin variants builder at /p/test#skinvariantsbuilder
-   *
-   * For the colibris skin only, you can choose how to render the three main
-   * containers:
-   * - toolbar (top menu with icons)
-   * - editor (containing the text of the pad)
-   * - background (area outside of editor, mostly visible when using page style)
-   *
-   * For each of the 3 containers you can choose 4 color combinations:
-   * super-light, light, dark, super-dark.
-   *
-   * For example, to make the toolbar dark, you will include "dark-toolbar" into
-   * skinVariants.
-   *
-   * You can provide multiple skin variants separated by spaces. Default
-   * skinVariant is "super-light-toolbar super-light-editor light-background".
-   *
-   * For the editor container, you can also make it full width by adding
-   * "full-width-editor" variant (by default editor is rendered as a page, with
-   * a max-width of 900px).
-   */
-  "skinVariants": "super-light-toolbar super-light-editor light-background",
-
-  /*
-   * IP and port which Etherpad should bind at.
-   *
-   * Binding to a Unix socket is also supported: just use an empty string for
-   * the ip, and put the full path to the socket in the port parameter.
-   *
-   * EXAMPLE USING UNIX SOCKET:
-   *    "ip": "",                             // <-- has to be an empty string
-   *    "port" : "/somepath/etherpad.socket", // <-- path to a Unix socket
-   */
-  "ip": "127.0.0.1",
-  "port": 9001,
-
-  /*
-   * Option to hide/show the settings.json in admin page.
-   *
-   * Default option is set to true
-   */
-  "showSettingsInAdminPage": true,
-
-  /*
-   * Node native SSL support
-   *
-   * This is disabled by default.
-   * Make sure to have the minimum and correct file access permissions set so
-   * that the Etherpad server can access them
-   */
-
-  /*
-  "ssl" : {
-            "key"  : "/path-to-your/epl-server.key",
-            "cert" : "/path-to-your/epl-server.crt",
-            "ca": ["/path-to-your/epl-intermediate-cert1.crt", "/path-to-your/epl-intermediate-cert2.crt"]
-          },
-  */
-
-  /*
-   * The type of the database.
-   *
-   * You can choose between many DB drivers, for example: dirty, postgres,
-   * sqlite, mysql.
-   *
-   * You shouldn't use "dirty" for for anything else than testing or
-   * development.
-   *
-   *
-   * Database specific settings are dependent on dbType, and go in dbSettings.
-   * Remember that since Etherpad 1.6.0 you can also store this information in
-   * credentials.json.
-   *
-   * For a complete list of the supported drivers, please refer to:
-   * https://www.npmjs.com/package/ueberdb2
-   */
-
-  /*
-   * An Example of MySQL Configuration (commented out).
-   *
-   * See: https://github.com/ether/etherpad-lite/wiki/How-to-use-Etherpad-Lite-with-MySQL
-   */
-
-  "dbType" : "mysql",
-  "dbSettings" : {
-    "user":     "{{ etherpad_database_user }}",
-    "host":     "localhost",
-    "port":     3306,
-    "password": "{{ etherpad_database_password }}",
-    "database": "{{ etherpad_database_name }}",
-    "charset":  "utf8mb4"
-  },
-
-  /*
-   * The default text of a pad
-   */
-  "defaultPadText" : "Conference info, how to watch/participate: https://emacsconf.org/2022/\nGuidelines for conduct: https://emacsconf.org/conduct/\nSee end of file for license (CC Attribution-ShareAlike 4.0 + GPLv3 or later)\n----------------------------------------------------------------\nQuestions and discussion go here:\n- \n- \n- \n- \n- \n- \n- \n\n----------------------------------------------------------------\nExcept where otherwise noted, the material on the EmacsConf pad are dual-licensed under the terms of the Creative Commons Attribution-ShareAlike 4.0 International Public License; and the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) an later version. Copies of these two licenses are included in the EmacsConf wiki repository, in the COPYING.GPL and COPYING.CC-BY-SA files (https://emacsconf.org/COPYING/)\n\nBy contributing to this pad, you agree to make your contributions available under the above licenses. You are also promising that you are the author of your changes, or that you copied them from a work in the public domain or a work released under a free license that is compatible with the above two licenses. DO NOT SUBMIT COPYRIGHTED WORK WITHOUT PERMISSION.",
-
-  /*
-   * Default Pad behavior.
-   *
-   * Change them if you want to override.
-   */
-  "padOptions": {
-    "noColors":         false,
-    "showControls":     true,
-    "showChat":         false,
-    "showLineNumbers":  true,
-    "useMonospaceFont": false,
-    "userName":         null,
-    "userColor":        null,
-    "rtl":              false,
-    "alwaysShowChat":   false,
-    "chatAndUsers":     false,
-    "lang":             null
-  },
-
-  /*
-   * Pad Shortcut Keys
-   */
-  "padShortcutEnabled" : {
-    "altF9":     true, /* focus on the File Menu and/or editbar */
-    "altC":      true, /* focus on the Chat window */
-    "cmdShift2": true, /* shows a gritter popup showing a line author */
-    "delete":    true,
-    "return":    true,
-    "esc":       true, /* in mozilla versions 14-19 avoid reconnecting pad */
-    "cmdS":      true, /* save a revision */
-    "tab":       true, /* indent */
-    "cmdZ":      true, /* undo/redo */
-    "cmdY":      true, /* redo */
-    "cmdI":      true, /* italic */
-    "cmdB":      true, /* bold */
-    "cmdU":      true, /* underline */
-    "cmd5":      true, /* strike through */
-    "cmdShiftL": true, /* unordered list */
-    "cmdShiftN": true, /* ordered list */
-    "cmdShift1": true, /* ordered list */
-    "cmdShiftC": true, /* clear authorship */
-    "cmdH":      true, /* backspace */
-    "ctrlHome":  true, /* scroll to top of pad */
-    "pageUp":    true,
-    "pageDown":  true
-  },
-
-  /*
-   * Should we suppress errors from being visible in the default Pad Text?
-   */
-  "suppressErrorsInPadText": false,
-
-  /*
-   * If this option is enabled, a user must have a session to access pads.
-   * This effectively allows only group pads to be accessed.
-   */
-  "requireSession": false,
-
-  /*
-   * Users may edit pads but not create new ones.
-   *
-   * Pad creation is only via the API.
-   * This applies both to group pads and regular pads.
-   */
-  "editOnly": false,
-
-  /*
-   * If true, all css & js will be minified before sending to the client.
-   *
-   * This will improve the loading performance massively, but makes it difficult
-   * to debug the javascript/css
-   */
-  "minify": true,
-
-  /*
-   * How long may clients use served javascript code (in seconds)?
-   *
-   * Not setting this may cause problems during deployment.
-   * Set to 0 to disable caching.
-   */
-  "maxAge": 21600, // 60 * 60 * 6 = 6 hours
-
-  /*
-   * Absolute path to the Abiword executable.
-   *
-   * Abiword is needed to get advanced import/export features of pads. Setting
-   * it to null disables Abiword and will only allow plain text and HTML
-   * import/exports.
-   */
-  "abiword": null,
-
-  /*
-   * This is the absolute path to the soffice executable.
-   *
-   * LibreOffice can be used in lieu of Abiword to export pads.
-   * Setting it to null disables LibreOffice exporting.
-   */
-  "soffice": null,
-
-  /*
-   * Path to the Tidy executable.
-   *
-   * Tidy is used to improve the quality of exported pads.
-   * Setting it to null disables Tidy.
-   */
-  "tidyHtml": null,
-
-  /*
-   * Allow import of file types other than the supported ones:
-   * txt, doc, docx, rtf, odt, html & htm
-   */
-  "allowUnknownFileEnds": false,
-
-  /*
-   * This setting is used if you require authentication of all users.
-   *
-   * Note: "/admin" always requires authentication.
-   */
-  "requireAuthentication": false,
-
-  /*
-   * Require authorization by a module, or a user with is_admin set, see below.
-   */
-  "requireAuthorization": false,
-
-  /*
-   * When you use NGINX or another proxy/load-balancer set this to true.
-   *
-   * This is especially necessary when the reverse proxy performs SSL
-   * termination, otherwise the cookies will not have the "secure" flag.
-   *
-   * The other effect will be that the logs will contain the real client's IP,
-   * instead of the reverse proxy's IP.
-   */
-  "trustProxy": true,
-
-  /*
-   * Settings controlling the session cookie issued by Etherpad.
-   */
-  "cookie": {
-    /*
-     * Value of the SameSite cookie property. "Lax" is recommended unless
-     * Etherpad will be embedded in an iframe from another site, in which case
-     * this must be set to "None". Note: "None" will not work (the browser will
-     * not send the cookie to Etherpad) unless https is used to access Etherpad
-     * (either directly or via a reverse proxy with "trustProxy" set to true).
-     *
-     * "Strict" is not recommended because it has few security benefits but
-     * significant usability drawbacks vs. "Lax". See
-     * https://stackoverflow.com/q/41841880 for discussion.
-     */
-    "sameSite": "Lax",
-
-    /*
-     * How long (in milliseconds) after navigating away from Etherpad before the
-     * user is required to log in again. (The express_sid cookie is set to
-     * expire at time now + sessionLifetime when first created, and its
-     * expiration time is periodically refreshed to a new now + sessionLifetime
-     * value.) If requireAuthentication is false then this value does not really
-     * matter.
-     *
-     * The "best" value depends on your users' usage patterns and the amount of
-     * convenience you desire. A long lifetime is more convenient (users won't
-     * have to log back in as often) but has some drawbacks:
-     *   - It increases the amount of state kept in the database.
-     *   - It might weaken security somewhat: The cookie expiration is refreshed
-     *     indefinitely without consulting authentication or authorization
-     *     hooks, so once a user has accessed a pad, the user can continue to
-     *     use the pad until the user leaves for longer than sessionLifetime.
-     *
-     * Session lifetime can be set to infinity (not recommended) by setting this
-     * to null or 0. Note that if the session does not expire, most browsers
-     * will delete the cookie when the browser exits, but a session record is
-     * kept in the database forever.
-     */
-    "sessionLifetime": 864000000, // = 10d * 24h/d * 60m/h * 60s/m * 1000ms/s
-
-    /*
-     * How long (in milliseconds) before the expiration time of an active user's
-     * session is refreshed (to now + sessionLifetime). This setting affects the
-     * following:
-     *   - How often a new session expiration time will be written to the
-     *     database.
-     *   - How often each user's browser will ping the Etherpad server to
-     *     refresh the expiration time of the session cookie.
-     *
-     * High values reduce the load on the database and the load from browsers,
-     * but can shorten the effective session lifetime if Etherpad is restarted
-     * or the user navigates away.
-     *
-     * Automatic session refreshes can be disabled (not recommended) by setting
-     * this to null.
-     */
-    "sessionRefreshInterval": 86400000 // = 1d * 24h/d * 60m/h * 60s/m * 1000ms/s
-  },
-
-  /*
-   * Privacy: disable IP logging
-   */
-  "disableIPlogging": true,
-
-  /*
-   * Time (in seconds) to automatically reconnect pad when a "Force reconnect"
-   * message is shown to user.
-   *
-   * Set to 0 to disable automatic reconnection.
-   */
-  "automaticReconnectionTimeout": 0,
-
-  /*
-   * By default, when caret is moved out of viewport, it scrolls the minimum
-   * height needed to make this line visible.
-   */
-  "scrollWhenFocusLineIsOutOfViewport": {
-
-    /*
-     * Percentage of viewport height to be additionally scrolled.
-     *
-     * E.g.: use "percentage.editionAboveViewport": 0.5, to place caret line in
-     *       the middle of viewport, when user edits a line above of the
-     *       viewport
-     *
-     * Set to 0 to disable extra scrolling
-     */
-    "percentage": {
-      "editionAboveViewport": 0,
-      "editionBelowViewport": 0
-    },
-
-    /*
-     * Time (in milliseconds) used to animate the scroll transition.
-     * Set to 0 to disable animation
-     */
-    "duration": 0,
-
-    /*
-     * Flag to control if it should scroll when user places the caret in the
-     * last line of the viewport
-     */
-    "scrollWhenCaretIsInTheLastLineOfViewport": false,
-
-    /*
-     * Percentage of viewport height to be additionally scrolled when user
-     * presses arrow up in the line of the top of the viewport.
-     *
-     * Set to 0 to let the scroll to be handled as default by Etherpad
-     */
-    "percentageToScrollWhenUserPressesArrowUp": 0
-  },
-
-  /*
-   * User accounts. These accounts are used by:
-   *   - default HTTP basic authentication if no plugin handles authentication
-   *   - some but not all authentication plugins
-   *   - some but not all authorization plugins
-   *
-   * User properties:
-   *   - password: The user's password. Some authentication plugins will ignore
-   *     this.
-   *   - is_admin: true gives access to /admin. Defaults to false. If you do not
-   *     uncomment this, /admin will not be available!
-   *   - readOnly: If true, this user will not be able to create new pads or
-   *     modify existing pads. Defaults to false.
-   *   - canCreate: If this is true and readOnly is false, this user can create
-   *     new pads. Defaults to true.
-   *
-   * Authentication and authorization plugins may define additional properties.
-   *
-   * WARNING: passwords should not be stored in plaintext in this file.
-   *          If you want to mitigate this, please install ep_hash_auth and
-   *          follow the section "secure your installation" in README.md
-   */
-
-  /*
-  "users": {
-    "admin": {
-      // 1) "password" can be replaced with "hash" if you install ep_hash_auth
-      // 2) please note that if password is null, the user will not be created
-      "password": "changeme1",
-      "is_admin": true
-    },
-    "user": {
-      // 1) "password" can be replaced with "hash" if you install ep_hash_auth
-      // 2) please note that if password is null, the user will not be created
-      "password": "changeme1",
-      "is_admin": false
-    }
-  },
-  */
-
-  /*
-   * Restrict socket.io transport methods
-   */
-  "socketTransportProtocols" : ["xhr-polling", "jsonp-polling", "htmlfile"],
-
-  "socketIo": {
-    /*
-     * Maximum permitted client message size (in bytes). All messages from
-     * clients that are larger than this will be rejected. Large values make it
-     * possible to paste large amounts of text, and plugins may require a larger
-     * value to work properly, but increasing the value increases susceptibility
-     * to denial of service attacks (malicious clients can exhaust memory).
-     */
-    "maxHttpBufferSize": 10000
-  },
-
-  /*
-   * Allow Load Testing tools to hit the Etherpad Instance.
-   *
-   * WARNING: this will disable security on the instance.
-   */
-  "loadTest": true,
-
-  /**
-  * Disable dump of objects preventing a clean exit
-  */
-  "dumpOnUncleanExit": false,
-
-  /*
-   * Disable indentation on new line when previous line ends with some special
-   * chars (':', '[', '(', '{')
-   */
-
-  /*
-  "indentationOnNewLine": false,
-  */
-
-  /*
-   * From Etherpad 1.8.3 onwards, import and export of pads is always rate
-   * limited.
-   *
-   * The default is to allow at most 10 requests per IP in a 90 seconds window.
-   * After that the import/export request is rejected.
-   *
-   * See https://github.com/nfriedly/express-rate-limit for more options
-   */
-  "importExportRateLimiting": {
-    // duration of the rate limit window (milliseconds)
-    "windowMs": 90000,
-
-    // maximum number of requests per IP to allow during the rate limit window
-    "max": 10
-  },
-
-  /*
-   * From Etherpad 1.8.3 onwards, the maximum allowed size for a single imported
-   * file is always bounded.
-   *
-   * File size is specified in bytes. Default is 50 MB.
-   */
-  "importMaxFileSize": 52428800, // 50 * 1024 * 1024
-
-  /*
-   * From Etherpad 1.8.5 onwards, when Etherpad is in production mode commits from individual users are rate limited
-   *
-   * The default is to allow at most 10 changes per IP in a 1 second window.
-   * After that the change is rejected.
-   *
-   * See https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example#websocket-single-connection-prevent-flooding for more options
-   */
-  "commitRateLimiting": {
-    // duration of the rate limit window (seconds)
-    "duration": 1,
-
-    // maximum number of changes per IP to allow during the rate limit window
-    "points": 10
-  },
-
-  /*
-   * Toolbar buttons configuration.
-   *
-   * Uncomment to customize.
-   */
-
-  /*
-  "toolbar": {
-    "left": [
-      ["bold", "italic", "underline", "strikethrough"],
-      ["orderedlist", "unorderedlist", "indent", "outdent"],
-      ["undo", "redo"],
-      ["clearauthorship"]
-    ],
-    "right": [
-      ["importexport", "timeslider", "savedrevision"],
-      ["settings", "embed"],
-      ["showusers"]
-    ],
-    "timeslider": [
-      ["timeslider_export", "timeslider_returnToPad"]
-    ]
-  },
-  */
-
-  /*
-   * Expose Etherpad version in the web interface and in the Server http header.
-   *
-   * Do not enable on production machines.
-   */
-  "exposeVersion": false,
-
-  /*
-   * The log level we are using.
-   *
-   * Valid values: DEBUG, INFO, WARN, ERROR
-   */
-  "loglevel": "INFO",
-
-  /* Override any strings found in locale directories */
-  "customLocaleStrings": {},
-
-  /* Disable Admin UI tests */
-  "enableAdminUITests": false
-}
diff --git a/roles/pad/templates/settings.json b/roles/pad/templates/settings.json
index 08b46dc..f81d232 100644
--- a/roles/pad/templates/settings.json
+++ b/roles/pad/templates/settings.json
@@ -1,4 +1,6 @@
 /*
+ * {{ ansible_managed }}
+ *
  * This file must be valid JSON. But comments are allowed
  *
  * Please edit settings.json, not settings.json.template
@@ -281,7 +283,7 @@
    * Pad creation is only via the API.
    * This applies both to group pads and regular pads.
    */
-  "editOnly": true,
+  "editOnly": {{ not etherpad_load_test }},
 
   /*
    * If true, all css & js will be minified before sending to the client.
@@ -528,7 +530,7 @@
    *
    * WARNING: this will disable security on the instance.
    */
-  "loadTest": false,
+  "loadTest": {{ etherpad_load_test }},
 
   /**
   * Disable dump of objects preventing a clean exit
diff --git a/roles/wiki-edit/templates/emacsconf-edit.el b/roles/wiki-edit/templates/emacsconf-edit.el
index 78e11a8..2e360c7 100644
--- a/roles/wiki-edit/templates/emacsconf-edit.el
+++ b/roles/wiki-edit/templates/emacsconf-edit.el
@@ -1,3 +1,5 @@
+;; {{ ansible_managed }}
+
 (let ((packages '({% for package in emacsconf_edit_packages %}{{ package }}{% endfor %})))
   (mapc (lambda (package) (unless (package-installed-p package) (package-install package))) packages))
 ;; Configuration
diff --git a/roles/wiki-publish/templates/emacsconf-config.el b/roles/wiki-publish/templates/emacsconf-config.el
index 53ffe64..cfb554e 100644
--- a/roles/wiki-publish/templates/emacsconf-config.el
+++ b/roles/wiki-publish/templates/emacsconf-config.el
@@ -1,3 +1,5 @@
+;; {{ ansible_managed }}
+
 (add-to-list 'load-path "{{ emacsconf_el_dir }}")
 (require 'emacsconf)
 (require 'emacsconf-publish)
diff --git a/roles/wiki/templates/Scrubber.pm b/roles/wiki/templates/Scrubber.pm
index 2efaa10..a06a209 100644
--- a/roles/wiki/templates/Scrubber.pm
+++ b/roles/wiki/templates/Scrubber.pm
@@ -1,3 +1,4 @@
+# {{ ansible_managed }}
 package HTML::Scrubber;
 
 # ABSTRACT: Perl extension for scrubbing/sanitizing html
diff --git a/roles/wiki/templates/copyright.pm b/roles/wiki/templates/copyright.pm
index 16acacc..e496aad 100644
--- a/roles/wiki/templates/copyright.pm
+++ b/roles/wiki/templates/copyright.pm
@@ -1,3 +1,4 @@
+# {{ ansible_managed }}
 # A plugin for ikiwiki to implement adding a footer with copyright information
 # based on a default value taken out of a file.
 
diff --git a/roles/wiki/templates/emacsconf.setup b/roles/wiki/templates/emacsconf.setup
index 7ab3916..ea9c4c8 100644
--- a/roles/wiki/templates/emacsconf.setup
+++ b/roles/wiki/templates/emacsconf.setup
@@ -1,5 +1,4 @@
-# This file is managed by the wiki role in git@git.emacsconf.org:pub/emacsconf-ansible
-# Please make sure your changes are also reflected there.
+# {{ ansible_managed }}
 #
 # IkiWiki::Setup::Yaml - YAML formatted setup file
 #
diff --git a/roles/wiki/templates/htmlscrubber.pm b/roles/wiki/templates/htmlscrubber.pm
index 4cbf300..1ce95b2 100755
--- a/roles/wiki/templates/htmlscrubber.pm
+++ b/roles/wiki/templates/htmlscrubber.pm
@@ -1,4 +1,6 @@
 #!/usr/bin/perl
+# {{ ansible_managed }}
+
 package IkiWiki::Plugin::htmlscrubber;
 
 use warnings;
diff --git a/roles/wiki/templates/license.pm b/roles/wiki/templates/license.pm
index 651c039..eebab77 100644
--- a/roles/wiki/templates/license.pm
+++ b/roles/wiki/templates/license.pm
@@ -1,3 +1,4 @@
+# {{ ansible_managed }}
 # A plugin for ikiwiki to implement adding a footer with licensing information
 # based on a default value taken out of a file.