Role-ify everything that used to just be in the site.yml playbook; add ntp installation (fixes #3) and ufw reset tasks (fixes #4).