hosts: make a hacky, but hopefully working way of handling vpn

This isn't very clever, but it should work and be easily understandable.
We likely want to come up with a better way to do these hosts files
entirely, but it can wait until after freeze.

Signed-off-by: Kevin Fenzi <kevin@scrye.com>

roles/hosts/tasks/main.yml

@@ -10,21 +10,29 @@
 # Note that if it's not set it will just skip this play and do nothing.
 #
 - name: setup /etc/hosts for some clients
-  vars:
-    hosts_candidates_static:
-      - "{{ inventory_hostname }}-hosts"
-      - "{{ ansible_hostname }}-hosts"
-      - "{{ host_group }}-hosts"
-      - "{{ ansible_domain }}-hosts"
-      - "{{ datacenter }}-hosts"
   copy: src={{ item }} dest=/etc/hosts
-  with_first_found: >-
-    {{
-      (hosts_candidates_static + ["vpn"])
-      if (vpn | default(false)) and (datacenter | default('iad2')) != 'iad2'
-      else
-      (hosts_candidates_static + ["base"])
-    }}
+  with_first_found:
+  - "{{ inventory_hostname }}-hosts"
+  - "{{ ansible_hostname }}-hosts"
+  - "{{ host_group }}-hosts"
+  - "{{ ansible_domain }}-hosts"
+  - "{{ datacenter }}-hosts"
+  - "{{ hosts_base | default('base') }}"
+  when: not vpn
+  tags:
+  - config
+  - hosts
+
+- name: setup /etc/hosts for some clients
+  copy: src={{ item }} dest=/etc/hosts
+  with_first_found:
+  - "{{ inventory_hostname }}-hosts"
+  - "{{ ansible_hostname }}-hosts"
+  - "{{ host_group }}-hosts"
+  - "{{ ansible_domain }}-hosts"
+  - "{{ datacenter }}-hosts"
+  - "{{ hosts_base | default('vpn') }}"
+  when: vpn
   tags:
   - config
   - hosts