Manually re-did the flow using the UI and now passwordless webauthn works as well as username + password with one second factor (as opposed to prompting for both like it was before).
Again, I think installing this conditionally, if we also deploy the configs conditionally, makes sense.
I think it would be nice to stick to the list format used in all the other roles for the sake of consistency.
Maybe explicitly call this "Internal Club-Services" now that we have the category "Public Club-Services".
This file is commented out in the main netlan.network file and uses the same IP addresses. Maybe just removing it would clear up confusion or are there plans to re-establish it down the line?
If this doesn't work on our target platform, than maybe just don't have this check. Does this fail?