Put some variable in ./vars/main.yaml scope to avoid change in one
role import overwriting all successive use.

Do not stop the webserver before performing HTTP challenge (challenge
is on port 80, webserver should be listening on port 443 only).

As post-renewal hook just reload the webserver, don't restart.

Don't use random uuid as internal user refs for LDAP users, otherwise
administration from the web interface become impossible.

nagios-plugins-contrib not available on bullseye

Improved automatic settings for ssh agent.

Load and mem services against `physical` machine and not lxc guest.

Allows custom (non-ed25519) algorithm and verification of broken trust
chain, to work with current stable ca_manager implementation.

So that ssh-agent Host can be actively monitored by the Icinga controller.

New role to automate generation and issuing of certificate using a
`ca_manager` server.

Code is more sintentic and concise, and we avoid duplications.

When feasible, allows better tag/task filtering.

Add role prefix to role specifig variable to avoid conflicts when
using multiples role on the same machine on the same play.