move roles into host

Because we decided to support this way too and Azure host also does the same, so we are consistent.