Changed olcTLS attributes set from with_items to with_dict and run it twice (first time with ignore_errors), but at least it's seems to work reliably on both first run and subsequent runs.

  easier usage by others.

  ssl-cert group membership takes affect.
- Use with_items instead of with_dict to force the order of the loop items.
- Enable service ldaps bind after the olcTLS* settings were committed.

  file and running ldapadd/ ldapmodify, use an Ansible module instead.

Add openldap_ prefix to variable names, remove default random password, update documentation accordingly.

Instead of crontab entry, place a script in /etc/cron.daily (more package like, more portable to a different CM) for backups.

Move TLS certificate handling and initial firewall handling each to a seperate file, preparing to have them shared between roles or a to be a depended role.

Limit rules in UFW implies allow, remove allow rules (caused every run to be marked as changed). The internal_tls_{key,cert} variable were ignoring the playbook variable, so switched to use set_fact (less elegant but works). Copy cert and key after running apt-get install otherwise the group won't be present.