Put some variable in ./vars/main.yaml scope to avoid change in one
role import overwriting all successive use.

Do not stop the webserver before performing HTTP challenge (challenge
is on port 80, webserver should be listening on port 443 only).

As post-renewal hook just reload the webserver, don't restart.

Don't use random uuid as internal user refs for LDAP users, otherwise
administration from the web interface become impossible.

reword of task names

nagios-plugins-contrib not available on bullseye

Improved automatic settings for ssh agent.

Load and mem services against `physical` machine and not lxc guest.

Allows custom (non-ed25519) algorithm and verification of broken trust
chain, to work with current stable ca_manager implementation.

So that ssh-agent Host can be actively monitored by the Icinga controller.

New role to automate generation and issuing of certificate using a
`ca_manager` server.

Code is more sintentic and concise, and we avoid duplications.