roles/grafana/files/public-dashboards/home.json

-archive.json
\ No newline at end of file

roles/grafana/templates/grafana.ini.j2

@@ -352,7 +352,7 @@ strict_transport_security_max_age_seconds = 86400
 
 # Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json"
 {% if grafana_anonymous_access %}
-default_home_dashboard_path = /var/lib/grafana/public-dashboards/home.json
+default_home_dashboard_path = /var/lib/grafana/public-dashboards/archive.json
 {% else %}
 ;default_home_dashboard_path =
 {% endif %}

roles/install_arch/tasks/main.yml

@@ -7,9 +7,19 @@
   fail: msg="Not running in rescue system!"
   when: "'Hetzner Rescue' not in motd_contents.stdout and 'Rescue environment based on Alpine Linux' not in motd_contents.stdout"
 
-- name: Make sure all required packages are installed in the rescue system for installation
-  apk: name=sgdisk,btrfs-progs,tar update_cache=yes
+- name: Prepare Equinix Metal rescue system
   when: ansible_facts['os_family'] == "Alpine"
+  block:
+    - name: Make sure all required packages are installed in the rescue system
+      apk: name=sgdisk,btrfs-progs,tar,gnupg update_cache=yes
+
+    - name: Create the GnuPG home directory for the root user
+      file: path=/root/.gnupg state=directory owner=root group=root mode=0700
+
+    # Need to set no-use-tor otherwise dirmngr hangs at startup checking if
+    # 127.0.0.1:9050 works and remains in SYN-SENT state for about a minute
+    - name: Set the no-use-tor option in dirmngr.conf
+      lineinfile: name=/root/.gnupg/dirmngr.conf create=yes line=no-use-tor owner=root group=root mode=0644
 
 - name: Create GRUB embed partitions
   command: sgdisk -g --clear -n 1:0:+1M {{ item }} -c 1:boot -t 1:ef02
@@ -42,9 +52,20 @@
 
 - name: Download bootstrap image
   get_url:
-    url: https://geo.mirror.pkgbuild.com/iso/{{ bootstrap_version }}/archlinux-bootstrap-x86_64.tar.gz
+    url: "{{ item }}"
     dest: /tmp/
     mode: 0644
+  loop:
+    - https://geo.mirror.pkgbuild.com/iso/{{ bootstrap_version }}/archlinux-bootstrap-x86_64.tar.gz
+    - https://archlinux.org/iso/{{ bootstrap_version }}/archlinux-bootstrap-x86_64.tar.gz.sig
+
+- name: Get pierre's key
+  command: gpg --locate-keys pierre@archlinux.de
+  changed_when: false
+
+- name: Verify bootstrap image signature
+  command: gpg --verify /tmp/archlinux-bootstrap-x86_64.tar.gz.sig
+  changed_when: false
 
 - name: Extract boostrap image  # noqa risky-file-permissions
   unarchive: