Also add certbot role to deploy.yaml playbook and add accompanying group.
This makes a full deployment of all hosts easier and parallelises execution of roles, which are used for multiple hosts. You can still easily deploy only a subset of hosts using the -l flag for ansible-playbook.