This comes in two parts:

1. Review ansible roles to make sure they do what we expect, and that the servers are in the state the roles represent. We need to be able to apply these repeatedly.
2. Make the roles apply automatically. This moves focus of infra changes to pull-request reviews where we can discuss/review and apply by merging.