Add comment explaining how ferm config file works
Add a custom list of Ansible Controllers in ferm

DebOps playbook automatically finds an protects an IP address of Ansible
Controller, to avoid it being blocked in the iptables firewall by recent
filter. This is done via a separate play in 'common.yml' playbook, which
is run without root privileges and can read the IP address of incoming
server from $SSH_CLIENT variable. When 'debops.ferm' role is used
without 'ansible_controller' variable set, this protection is not
enabled.

Because of that I have added 'ferm_ansible_controllers' list which
will serve a similar function - add listed hosts to recent filter
protection. Specified IP addresses must be set from the remote host
point of view, for example a router on a host behind NAT, or an IP
address of a jumphost/bastion host.

Additionally, list of Ansible Controllers is saved on the remote host in
Ansible local facts, and can be reused later to enforce the
configuration correctly.
Merge pull request #1 from drybjed/ferm-updates

Ferm updates