debops.rsyslog and rsyslog__send_permitted_peers

Hello. First email. I've been using debops for a few months now. Great tool, thanks for it. I have found what I think might be a problem with the newer version of debops.rsyslog. Error I get from syslog is: Aug 28 12:19:24 ajax rsyslogd: error: peer name not authorized -  not permitted to talk to it. Names: DNSname: internal.org; DNSname: *.internal.org; CN: sirius.i.internal.org;  [v8.32.0 try http://www.rsyslog.com/e/2088 ] I had thought (and still think) the issue is the certificate that I am being kludgy about (the sending host is ajax.internal.org sending to sirius.i.internal.org through a NAT, and I was thinking that since ajax can not lookup the i.internal.org domain, it was some GNU TLS check that was failing. After playing around and reading, I found rsyslog__send_permitted_peers, but in the code I see it declared but it never ends up in the config file.  Also, the documentation states: rsyslog__send_permitted_peers: '{{ rsyslog__permitted_peers }}'. BUT, while for the receiver (in remote.input) permittedPeer can be an array, for the sender, ( in 00-forward-logs.conf) the directive is streamDriverPermittedPeers and has to be a string. (at least I think that is what the ryslsog documentation says) I modified debops/ansible/roles/rsyslog/defaults/main.yml as seen in the diff below to get rsyslog__send_permitted_peers in the forward file. I'll cut and paste a diff below. Has anyone else had this problem, or am I wrong that this is an issue? 73,675d672 <           {%   if rsyslog__send_permitted_peers is string %} <                 streamDriverPermittedPeers="{{ rsyslog__send_permitted_peers }}" <           {% endif %} Thanks.