hiera: show what's in private.yaml

But obfuscate values.
hostapd: ensure that the configuration file is not world-readable
dnsmasq: don't read /etc/hosts

This is useless.
dnsmasq: change default domain
dnsmasq: use dnsmasq for local resolution too

Therefore, we need to let dhclient write /etc/resolv.conf into another place.
dnsmasq: create a A record with firewall address
dnsmasq: keep new lines in resolv.conf.dhclient
dnsmasq: use "local" domain, not "home"
Revert "dnsmasq: use "local" domain, not "home""

This reverts commit bee2645ac8b3e1080c24a1ea1a96017c19fa052d. There is
no "local" resolution if mdns is enabled.
firewall: enable codel and fair queuing
firewall: allow access to 80/443 on firewall