I am currently taking my first steps with ansible, so this might be a basic question.
I am trying to configure a server with ansible that hosts a couple of webpages and exposes a number of other services as well. For each of these, I optionally want to be able to
- Register a subdomain with the nameserver that is one of the services
- Use Let's Encrypt to issue a certificate for the service
- Open sme ports in my firewall
I currently also have roles to setup nameserver, let's encrypt, and firewall. What are the best practises to communicate between the roles? Should e.g. the webserver role know the exact command how to create a certificate for itself, or is there a way to abstract this to a notify call maybe? Should each service role be able to write to my firewall configuration file, or should this be a privilege of the firewall role somehow?
Maybe I am too much in a programmer's mindset, but I like things like "separation on concern" and I'd like to be able to change e.g. my firewall software without having to change every other role as well.