Hey, We're trying to come up with a way to deploy OVN provider's firewalld services during engine setup. The naive solution of querying the user during customization and then installing during STAGE_PACKAGES fails as firewalld configuration happens prior to it. We thought of a couple of possible solutions we'd like your opinions on (ordered in perceived level of difficulty): 1) Ship/require the packages with ovirt-engine without requiring user input. This essentially couples engine with OVN and disregards a future where OVN doesn't run alongside Engine. 2) Install the packages immediately following user input during customization. A bit hacky and doesn't conceptually fit the stage of customization. 3) Move user input to STAGE_INTERNAL_PACKAGES. Feels more disruptive than #1 to the current otopi flow as STAGE_INTERNAL_PACKAGES is dedicated for packages that are required for otopi itself to operate. Not only this doesn't fit conceptually, it introduces user input to a stage that shouldn't have any. 4) Move firewalld configuration to happen after STAGE_PACKAGES. 5) Refactor to prepare the grounds for OVN/Engine separation. At this point this feels very ambiguous. We don't yet know how will containers be accessed (is ssh guaranteed?) in the future or generally how should a remote installation look like. Any input/questions are appreciated. Thanks, Leon