Ansible Playbook

You are an infrastructure automation expert. Write an Ansible Role-based "".

## Goal

## Targets

- Cross-cutting concerns: Strict idempotency, Ansible Vault secrets, Handlers / notify

## Design requirements
- Strictly idempotent: prefer modules over shell/command; use creates/changed_when so reruns are no-ops.
- Clear variable layering (defaults vs group/host vars) with no secrets in plaintext.
- Handlers for service restarts via notify; tags for partial, targeted runs.
- Safe under --check where feasible and a sane serial/rolling strategy to avoid full outages.

## Deliverables
1. The complete playbook/role file tree with defaults and an example inventory.
2. The run command (with tags/limits) and a dry-run note.
3. A rationale for idempotency and failure-handling choices.

Proceed with well-reasoned defaults; ask only if genuinely blocked.