Philip Freeman

it randomizes it just once, by touching a file that allows ansible to skip it next time.

reprovision from scratch? I'm unsure what you mean. It doesn't sound possible without writing an equivalent un-provision script to remove packages, revert system config files, etc..

looks like the secret_key is used for signing cookies: https://github.com/grafana/grafana/blob/6af62abd41c4f2b752772a9b816d4c68b734ef28/docs/sources/installation/configuration.md#secret_key So my changes would re-generate the secret key on the first (or next) pass through the grafana role, invalidating 'keep...

The grafana_secret being override-able makes sense to me. I'll take a stab at that later and resubmit a cleaner PR. Hmm, An immutable root partition would be neat, but would...