change DANE TLSA record to hash the subject public key rather than the whole certificate, which means it is good for any certificate tied to the same private key

Better for short-lived certificates. This is especially in preparation to using certificates from Let's Encrypt.

see #268

previously these were run in a cron.daily script which per crontab is run at 6:25 am local time

clean up the backup time patch: dont choose timezone here, move status checks into the same 3am script

closes #294
see #328
maybe related to #235

tiny tweaks to make the bash docs slightly more readable

Activate FAIL2BAN recidive jail

Add alias for abuse@

don't install bind9-host when setting hostname

also remove an incorrect comment

fail2ban: whitelist our machine's public ip address so status checks dont cause bans of the machine itself

make the system SSL certificate a symlink so we never have to replace a certificate file, and flatten the directory structure of user-installed certificates

GCE installs some Python-2-only boto plugin that conflicts with boto running under Python 3. It gives a SyntaxError in /usr/share/google/boto/boto_plugins/compute_auth.py (https://github.com/GoogleCloudPlatform/compute-image-packages).

Disabling boto's default configuration file prior to importing boto so that GCE's plugin is not loaded.

See https://discourse.mailinabox.email/t/500-internal-server-error-for-admin/942.

Typo on 'weirdly'

use /dev/urandom for roundcube/owncloud key generation, see #596, partially reverts #115 (69f0e1d0)

use /dev/urandom for DNSSEC key generation, fixes #596, partially reverts #115 (69f0e1d0)

ensure /dev/urandom is seeded with a blocking call to /dev/random and using Ubuntu's pollinate servers

add comments about how openssl generates random numbers for genrsa and what could create a perfect storm to make the key not random

see #596