Better tarsnap configuration

[taoeffect]

• All data should be in /root/.tarsnap, this includes the tarsnap.key (Get rid of roles/tarsnap/files/decrypted_tarsnap.key #53) and the cache directory
• The /root/.tarsnaprc should look like so:

keyfile ~/.tarsnap/tarsnap.key
cachedir ~/.tarsnap/cache
exclude ~/.tarsnap/cache
humanize-numbers
print-stats
totals

Having Tarsnap's key and cache directory in separate locations is ugly and confusing. Plus currently the cache directory is world-readable, and that's not good as it contains plaintext filenames.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/6645536-better-tarsnap-configuration?utm_campaign=plugin&utm_content=tracker%2F8064840&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F8064840&utm_medium=issues&utm_source=github).

[taoeffect]

Also, @al3x or @PiPeep, do either one of you know why tarsnap.sh uses the -L option:

EXTRA_FLAGS="-L -C /"

That tells it to follow links when archiving instead of backing them up as links. Since this is backing up the entire system, that seems like the wrong thing to do... Anything that's pointed to by the link will be backed up, and upon restoration users probably want the link, not the file. So can the -L be removed or is there a reason for it?