Changed olcTLS attributes set from with_items to with_dict and run it twice (first time with ignore_errors), but at least it's seems to work reliably on both first run and subsequent runs.

  easier usage by others.

  ssl-cert group membership takes affect.
- Use with_items instead of with_dict to force the order of the loop items.
- Enable service ldaps bind after the olcTLS* settings were committed.

  file and running ldapadd/ ldapmodify, use an Ansible module instead.

Add openldap_ prefix to variable names, remove default random password, update documentation accordingly.

Instead of crontab entry, place a script in /etc/cron.daily (more package like, more portable to a different CM) for backups.

Move TLS certificate handling and initial firewall handling each to a seperate file, preparing to have them shared between roles or a to be a depended role.