- hosts: spine-*
  roles:
    - spine

- hosts: leaf-*
  roles:
    - leaf

- hosts: exit-*
  roles:
    - exit

- hosts: access-*, sw-*
  gather_facts: false
  roles:
    - access

- hosts: fw-*
  roles:
    - firewall

- hosts: zid
  roles:
    - certbot_dns
    - firewall_master