Some suggestions

These are for consideration, we might or might not want to use them. If the consensus is that we should make any of these changes, I'm happy to work on them and submit pull requests.
- When installing packages, add "update_cache=yes cache_valid_time=3600" so if the apt indices haven't been updated in the last hour, Ansible will update them first. (We can probably just do this in the "common" role, since it's going to always run first.)
- When installing packages, change "state=present" to "state=latest" so we upgrade when upgrades are available.
- For adding github to the ssh known hosts, there's a "known_hosts" module in Ansible.
- I would split up the "balancer" role, maybe having an "nginx" role that gets nginx installed, common configuration, and the service running, and then a separate role for adding a specific project's config, directories, SSL cert, etc to nginx.
- Similarly, "db-master" could get postgres server installed, while another role does project-specific things like creating postgres users and databases. We might also have a postgres client role - we have some projects that are going to start using RDS so they will need the postgres client packages but not the server installed.
- Set a default value for pg_version in the db-master role

Start by reviewing the common, balancer, and db-master roles mentioned in the issue, along with their package, SSH known-host, nginx, and PostgreSQL tasks. The proposed changes need consensus and separate, scoped work items; done would mean an agreed role structure and individually reviewed pull requests for the selected changes.

Written by the indexing model from the issue text.