configure lo1
rename to expose both handlers
configure the webserver jail via sshd from outside

note: you currently need to manually start an SSH tunnel, i.e. like so::

ssh root@192.168.2.117 -L 22222:127.0.0.2:22

along with an entry in your host file like so::

[webserver]
webserver ansible_ssh_port=22222 ansible_ssh_host=localhost