Also: Let us control debug logging via portal-config! Debug logs have value - but there is a strong argument that they should not be on by default simply due to the amount generated (as is, every DNS request is logged), as well as the fact that on a multi-user system (RDS or hot-desking), they leak info that really shouldn't be visible to other users.

Anything where you've historically only provided the control plane via local registry edits or cli arguments at install (so 'edns fix', tray icon hiding, ARP hiding' - this should all be portal driven config flowing down from top to bottom.