Break the config-distribution play out into two.

This is necessary because of how "roles" preceed "loose tasks".
One role here rolls out some fedmsg certs and sets their group
to "sysadmin".. but since roles run before tasks fasClient has
never actually been run so the "sysadmin" group doesn't exist yet.
We need to ensure that those fasclient basic setup tasks get run
first (the first time) before the service-specific stuff gets run.

Another way to do this would be to make the "generic config" stuff
into a role that gets included in every playbook like this one.  We
put it first and it will get run before the other roles.  We should
consider that after some discussion.

playbooks/groups/badges-backend.yml

@@ -19,18 +19,11 @@
   handlers:
   - include: $handlers/restart_services.yml
 
-- name: make the box be real
+- name: dole out the generic configuration
   hosts: badges-backend;badges-backend-stg
   user: root
   gather_facts: True
 
-  # Roles are executed before all other "loose" items in a playbook regardless
-  # of where they appear in the yaml config.  We put them here first to help us
-  # remember that.
-  roles:
-  - /srv/web/infra/ansible/roles/fedmsg-hub
-  - /srv/web/infra/ansible/roles/badges-backend
-
   vars_files: 
    - /srv/web/infra/ansible/vars/global.yml
    - ${private}/vars.yml
@@ -51,3 +44,17 @@
 
   handlers:
   - include: $handlers/restart_services.yml
+
+- name: dole out the service-specific config
+  hosts: badges-backend;badges-backend-stg
+  user: root
+  gather_facts: True
+
+  roles:
+  - /srv/web/infra/ansible/roles/fedmsg-hub
+  - /srv/web/infra/ansible/roles/badges-backend
+
+  vars_files: 
+   - /srv/web/infra/ansible/vars/global.yml
+   - ${private}/vars.yml
+   - ${vars}/${ansible_distribution}.yml