todo.md

Use Ansible to do the things below:

1.  Disable root login
1.  Set up printer
1.  Add second LUKS passphrase
1.  Configure GRUB
1.  Configure auto login to improve user experience as LUKS is used
1.  Disable wait-online service unit
1.  Disable lp module
1.  Nextcloud als Sicherung
1.  Enable S3 over s2idle
1.  Use LZ4 for initrd image
1.  Set up firmware password
1.  Fix cryptsetup configuration
1.  Set Neovim as default editor
1.  Replace GRUB with Linux EFI stub
1.  Encrypt full disk including root
    a)  [Full disk encryption (including boot) on Debian](https://www.dwarmstrong.org/fde-debian/)
1.  Bigger font in GRUB
    a)  `sudo grub-mkfont --output=/boot/grub/fonts/DejaVuSansMono48.pf2 --size=48 /usr/share/fonts/truetype/dejavu/DejaVuSansMono.ttf`
    a)  In `/etc/default/grub`:

            GRUB_GFXPAYLOAD=keep
            GRUB_FONT=/boot/grub/fonts/DejaVuSansMono48.pf2
1.  Enable suite *sid* for unattended-upgrades in `Unattended-Upgrade::Origins-Pattern` in `/etc/apt/apt.conf.d/50unattended-upgrades`:

        "o=Debian,a=sid";