A new section has been added to configure firewalld automatically as the
last step of the server installation.

A new switch has been added to be able to turn firewalld configuration off:
ipaserver_no_firewalld. It defaults to no.

The client settings are:

ipaclient_mkhomedir
ipaclient_no_ntp
ipaclient_ssh_trust_dns
ipaclient_no_ssh
ipaclient_no_sshd
ipaclient_no_dns_sshfp

There is no way to repair a server installation like it is possible with a
client.

The support for external cert files is not complete yet.