Oops. Also do it for proxmox-backup role even though SSH in default VRF is disabled there, so it will be easier to deduplicate these roles when someone gets around to it.