Will split this up prior to submitting pr.
But moved the tasks to install the fpf/tor repos and run apt-get update are still in the common role.
The grsec kernel gets installed as part of the common role but it is not used until the server reboots.
The servers are not set to reboot if needed until the last role run ubdate_boot_grsec.
This role checks to see if the grsec sysctl lock is available if not it will reboot
After the reboot if the grsec sysctl lock is not set it will set it.

Still having an issue with the server somtimes not coming back up. I copied the production ansible.cfg to see if that would improve anything.
I added aptitude as a dependency to use the built in ansible module to update the system instead of having unattended-upgrades via an ansible command module peform the action. Not sure if my issue were due to this.

ansible_ssh_host is how the host checks to see if the server is up.
ansible_ssh_host is the same variable we have in the example production inventory file. It is also the same variable used by vagrant.