=== exchange ssh keys ===
-ipsum loren bacon puppet: the ssh keys for nodes must be added to root:/etc/.ssh/authorized_keys (or /etc/ssh/keys/root) on all nodes; puppet can handle this (poorly; needs improvement)
+on each node:
+
+{{{
+ mkdir -m 0700 -p /root/.ssh &&
+ ln -s /etc/ssh/ssh_host_rsa_key /root/.ssh/id_rsa
+}}}
=== configure iptables (via ferm) ===
=== add slave nodes ===
-For each slave node (only bar for this example), on the master node (foo):
+For each slave node (only bar for this example):
+
+on the slave, append the master's /etc/ssh/ssh_host_rsa_key to
+/etc/ssh/userkeys/root. This is only required temporarily - once
+everything works puppet will put it/keep it there.
+
+on the master node (foo):
{{{
gnt-node add \