With all this in mind, I think the least problematic alternative is to
have a fully automated configuration done in Ansible, with no manual
stuff and no precious files stored on the server.