Ultimately the service should work right after installing, if you
install -database and -remote and -web and have a keytab.
Maybe we want an invirt-all that pulls these together.

localhost doesn't work for Kerberos
  generate with hostname -f in postinst?
  fails in simultaneous install

allow to disable web-iptables