- ensure the firstrun is processed before role specific class profiles
- start creation on apps:: roles - reorganise hieradata to match role changes - remove tagging for enc repo