If you set "sudo_user" it will run the command as `sudo -u certs ...` which is what I want to do here.
It assumes that whoever is running the play has permission to do that, make sense?
At the toplevel play we have "sudo: True" though the end goal will be to run the tasks tagged "deploy" without full sudo, eventually.