ah yeah it does look like we need to add the role, sadly.
Here is the full `--tags deploy` run for edxapp where it appears the nginx tasks are being skipped.
https://gist.github.com/jarv/bbc92f3622d4ada2ee79