proxmox: only install firewall rules on one node

And let the cluster take care of distribution.

roles/proxmox/tasks/main.yml

@@ -2,6 +2,11 @@
   set_fact:
     nodes: "{{ groups['cluster_'+cluster] | map('extract', hostvars) }}"
 
+# choose a node for tasks that should only run on (any) one node, e.g. when writing to /etc/pve
+- name: Select primary node
+  set_fact:
+    primary: '{{ nodes | map(attribute="inventory_hostname") | sort | first }}'
+
 - name: Disable enterprise repositories
   apt_repository:
     repo: '{{ item }}'