diff --git a/.README.html b/.README.html
index d9ba230..57558d8 100644
--- a/.README.html
+++ b/.README.html
@@ -59,7 +59,7 @@
   <style type="text/css">code{white-space: pre;}</style>
   <style type="text/css">
 pre > code.sourceCode { white-space: pre; position: relative; }
-pre > code.sourceCode > span { display: inline-block; line-height: 1.25; }
+pre > code.sourceCode > span { line-height: 1.25; }
 pre > code.sourceCode > span:empty { height: 1.2em; }
 .sourceCode { overflow: visible; }
 code.sourceCode > span { color: inherit; text-decoration: inherit; }
@@ -70,7 +70,7 @@
 }
 @media print {
 pre > code.sourceCode { white-space: pre-wrap; }
-pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
+pre > code.sourceCode > span { display: inline-block; text-indent: -5em; padding-left: 5em; }
 }
 pre.numberSource code
   { counter-reset: source-line 0; }
@@ -268,7 +268,7 @@ <h1 id="top-level-variables">Top-level variables</h1>
 particular tunnel).</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -277,21 +277,21 @@ <h1 id="top-level-variables">Top-level variables</h1>
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td>vpn_provider</td>
 <td>VPN provider used (e.g. libreswan, wireguard, etc.)</td>
 <td style="text-align: center;">str</td>
 <td style="text-align: center;">no</td>
 <td>libreswan</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#vpn_auth_method">vpn_auth_method</a></td>
 <td>VPN authentication method used.</td>
 <td style="text-align: center;">str</td>
 <td style="text-align: center;">no</td>
 <td>psk</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>vpn_regen_keys</td>
 <td>Whether pre-shared keys should be regenerated for sets of hosts with
 existing keys.</td>
@@ -299,14 +299,14 @@ <h1 id="top-level-variables">Top-level variables</h1>
 <td style="text-align: center;">no</td>
 <td>false</td>
 </tr>
-<tr class="even">
+<tr>
 <td>vpn_opportunistic</td>
 <td>Whether an opportunistic mesh configuration should be used.</td>
 <td style="text-align: center;">bool</td>
 <td style="text-align: center;">no</td>
 <td>false</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>vpn_default_policy</td>
 <td>The default policy group to add target machines to under a mesh
 configuration.</td>
@@ -314,7 +314,7 @@ <h1 id="top-level-variables">Top-level variables</h1>
 <td style="text-align: center;">no</td>
 <td><code>private-or-clear</code></td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#vpn_ensure_openssl">vpn_ensure_openssl</a></td>
 <td>Ensure the <code>openssl</code> package is installed on the
 controller.</td>
@@ -322,7 +322,7 @@ <h1 id="top-level-variables">Top-level variables</h1>
 <td style="text-align: center;">no</td>
 <td>true</td>
 </tr>
-<tr class="odd">
+<tr>
 <td><a href="#vpn_connections">vpn_connections</a></td>
 <td>List of VPN connections to make.</td>
 <td style="text-align: center;">list</td>
@@ -368,7 +368,7 @@ <h1 id="connection-specific-variables">Connection-specific
 e.g. <code>13h</code> for 13 hours, <code>10s</code> for 10 seconds.</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -378,7 +378,7 @@ <h1 id="connection-specific-variables">Connection-specific
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td><a href="#name">name</a></td>
 <td>A unique, arbitrary name used to prefix the connection name.</td>
 <td style="text-align: center;">str</td>
@@ -386,7 +386,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>See <a href="#name">name</a></td>
 <td style="text-align: center;">conn <code>&lt;name&gt;</code></td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#hosts">hosts</a></td>
 <td>A VPN tunnel will be constructed between each pair of hosts in this
 dictionary.</td>
@@ -395,7 +395,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">-</td>
 </tr>
-<tr class="odd">
+<tr>
 <td><a href="#auth_method">auth_method</a></td>
 <td>Authentication method to be used for this connection.</td>
 <td style="text-align: center;">str</td>
@@ -403,7 +403,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>vpn_auth_method</td>
 <td style="text-align: center;">authby</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#auto">auto</a></td>
 <td>What operation, if any, should be done automatically at
 startup.</td>
@@ -412,7 +412,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">auto</td>
 </tr>
-<tr class="odd">
+<tr>
 <td><a href="#opportunistic">opportunistic</a></td>
 <td>Whether an opportunistic mesh configuration should be used.</td>
 <td style="text-align: center;">bool</td>
@@ -420,7 +420,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>vpn_opportunistic</td>
 <td style="text-align: center;">-</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#policies">policies</a></td>
 <td>List of policy settings to use for an opportunistic mesh
 configuration.</td>
@@ -429,7 +429,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">-</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>shared_key_content</td>
 <td>A pre-defined PSK. If not defined, the role will generate one using
 <code>openssl</code>. <strong>IMPORTANT:</strong> It is strongly
@@ -442,7 +442,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">PSK from ipsec.secrets file</td>
 </tr>
-<tr class="even">
+<tr>
 <td>ike</td>
 <td>IKE encryption/authentication algorithm to be used for the
 connection (phase 1 aka ISAKMP SA). <strong>NOTE</strong> Do not set
@@ -452,7 +452,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">ike</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>esp</td>
 <td>Specifies the algorithms that will be offered/accepted for a Child
 SA negotiation. <strong>NOTE</strong> Do not set this unless you must,
@@ -462,7 +462,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">esp</td>
 </tr>
-<tr class="even">
+<tr>
 <td>type</td>
 <td>The type of the connection. See the libreswan docs for the possible
 values</td>
@@ -471,7 +471,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>tunnel</td>
 <td style="text-align: center;">type</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>ikelifetime</td>
 <td>How long the keying channel of a connection (buzzphrase: "IKE SA" or
 "Parent SA") should last before being renegotiated.</td>
@@ -480,7 +480,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">ikelifetime</td>
 </tr>
-<tr class="even">
+<tr>
 <td>salifetime</td>
 <td>How long a particular instance of a connection (a set of
 encryption/authentication keys for user packets) should last, from
@@ -490,7 +490,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">salifetime</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>retransmit_timeout</td>
 <td>How long a single packet, including retransmits of that packet, may
 take before the IKE attempt is aborted.</td>
@@ -499,7 +499,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">retransmit-timeout</td>
 </tr>
-<tr class="even">
+<tr>
 <td>dpddelay</td>
 <td>Set the delay time between Dead Peer Detection (IKEv1 RFC 3706) or
 IKEv2 Liveness keepalives that are sent for this connection. If this is
@@ -509,7 +509,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">dpddelay</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>dpdtimeout</td>
 <td>Set the length of time that we will idle without hearing back from
 our peer. After this period has elapsed with no response and no traffic,
@@ -521,7 +521,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">dpdtimeout</td>
 </tr>
-<tr class="even">
+<tr>
 <td>dpdaction</td>
 <td>When a DPD enabled peer is declared dead, what action should be
 taken. See libreswan docs for values.</td>
@@ -530,7 +530,7 @@ <h1 id="connection-specific-variables">Connection-specific
 <td>-</td>
 <td style="text-align: center;">dpdaction</td>
 </tr>
-<tr class="odd">
+<tr>
 <td><a href="#leftupdown">leftupdown</a></td>
 <td>The "updown" script to run to adjust routing and/or firewalling when
 the status of the connection changes (default
@@ -624,7 +624,7 @@ <h2 id="policies">policies</h2>
 applied, and the CIDR value is <code>0.0.0.0/0</code>.</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -632,13 +632,13 @@ <h2 id="policies">policies</h2>
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td><a href="#policy">policy</a></td>
 <td>A valid policy connection group.</td>
 <td style="text-align: center;">str</td>
 <td style="text-align: center;">no</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#cidr">cidr</a></td>
 <td>A valid CIDR to which this policy rule is applied.</td>
 <td style="text-align: center;">str</td>
@@ -673,7 +673,7 @@ <h2 id="hosts">hosts</h2>
 parameters can be specified.</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -683,7 +683,7 @@ <h2 id="hosts">hosts</h2>
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td><a href="#hostname">hostname</a></td>
 <td>Host name or IP address to use for setting up a VPN connection.</td>
 <td style="text-align: center;">str</td>
@@ -691,7 +691,7 @@ <h2 id="hosts">hosts</h2>
 <td>-</td>
 <td style="text-align: center;">left/right</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#cert_name">cert_name</a></td>
 <td>Certificate nickname of this host's certificate in the NSS database.
 (Only used when <code>auth_method</code> is <code>cert</code>)</td>
@@ -700,7 +700,7 @@ <h2 id="hosts">hosts</h2>
 <td>-</td>
 <td style="text-align: center;">leftcert/rightcert</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>subnets</td>
 <td>A list of the subnets that should be available via the VPN
 connection.</td>
@@ -709,7 +709,7 @@ <h2 id="hosts">hosts</h2>
 <td>-</td>
 <td style="text-align: center;">leftsubnets/rightsubnets</td>
 </tr>
-<tr class="even">
+<tr>
 <td>leftid</td>
 <td>How the left participant (local) should be identified for
 authentication.</td>
@@ -718,7 +718,7 @@ <h2 id="hosts">hosts</h2>
 <td>the local host FQDN (not the controller)</td>
 <td style="text-align: center;">leftid</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>rightid</td>
 <td>How the right participant (remote) should be identified for
 authentication.</td>
@@ -773,7 +773,7 @@ <h1 id="firewall-and-selinux">Firewall and Selinux</h1>
 4500/UDP, and 4500/TCP ports for the IKE, ESP, and AH protocols.</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -782,7 +782,7 @@ <h1 id="firewall-and-selinux">Firewall and Selinux</h1>
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td>vpn_manage_firewall</td>
 <td>If true, enable the IPsec ports, 500/UDP, 4500/UDP, and 4500/TCP for
 the IKE, ESP, and AH protocols using the firewall role. If false, the
@@ -791,7 +791,7 @@ <h1 id="firewall-and-selinux">Firewall and Selinux</h1>
 <td style="text-align: center;">no</td>
 <td>false</td>
 </tr>
-<tr class="even">
+<tr>
 <td>vpn_manage_selinux</td>
 <td>If true, manage the IPsec ports, 500/UDP, 4500/UDP, and 4500/TCP
 using the selinux role. If false, the <code>vpn role</code> does not
@@ -990,7 +990,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 without certificates (enforces SHA-2).</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -999,7 +999,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td>vpn_enc_alg</td>
 <td>VPN encryption algorithm to use. See <a
 href="#algorithms">Algorithms section</a> for acceptable values.</td>
@@ -1007,21 +1007,21 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 <td style="text-align: center;">no</td>
 <td>-</td>
 </tr>
-<tr class="even">
+<tr>
 <td>vpn_auth_alg</td>
 <td>VPN authentication algorithm to use.</td>
 <td style="text-align: center;">str</td>
 <td style="text-align: center;">no</td>
 <td>SHA-2</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>vpn_wait</td>
 <td>If tasks should wait for the VPN tunnel to be started up.</td>
 <td style="text-align: center;">bool</td>
 <td style="text-align: center;">no</td>
 <td>false</td>
 </tr>
-<tr class="even">
+<tr>
 <td>vpn_public_key_src</td>
 <td>Path to file on the controller host containing public key used by
 default.</td>
@@ -1029,7 +1029,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 <td style="text-align: center;">no</td>
 <td>-</td>
 </tr>
-<tr class="odd">
+<tr>
 <td>vpn_public_key_content</td>
 <td>Contains the public key used by default for public key
 authentication without certificates.</td>
@@ -1043,7 +1043,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 href="#hosts"><code>hosts</code></a> dictionary:</p>
 <table>
 <thead>
-<tr class="header">
+<tr>
 <th>Parameter</th>
 <th>Description</th>
 <th style="text-align: center;">Type</th>
@@ -1053,7 +1053,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 </tr>
 </thead>
 <tbody>
-<tr class="odd">
+<tr>
 <td><a href="#public_key">public_key_src</a></td>
 <td>Path to file on the controller host containing public key used by
 this host.</td>
@@ -1062,7 +1062,7 @@ <h1 id="to-be-added-in-a-future-release">To be added in a future
 <td>-</td>
 <td style="text-align: center;">leftrsasigkey/rightrsasigkey</td>
 </tr>
-<tr class="even">
+<tr>
 <td><a href="#public_key">public_key_content</a></td>
 <td>Contains the public key used by this host for public key
 authentication without certificates.</td>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5a68660..a519c1d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,17 @@
 Changelog
 =========
 
+[1.6.7] - 2024-08-16
+--------------------
+
+### Other Changes
+
+- ci: Add tft plan and workflow (#162)
+- ci: Update fmf plan to add a separate job to prepare managed nodes (#164)
+- ci: Bump sclorg/testing-farm-as-github-action from 2 to 3 (#165)
+- ci: Add workflow for ci_test bad, use remote fmf plan (#166)
+- ci: Fix missing slash in ARTIFACTS_URL (#167)
+
 [1.6.6] - 2024-07-02
 --------------------