Fix #34: Make some config files read-only

This means that provisioning is finally idempotent.