Can’t get it to bind to IPv6 so use v4 explicitly.
This is pretty much anywhere a LE certificate is needed. Similar for nginx-php for PHP sites. Drop these roles from setup.yml.