i might be doing this wrong.. 

using a very simple playlist and including only the debops.pki role results in the following error.

it appears that the role attempts to write a .gitignore file to /etc/pki before the /etc/pki dir is created.

TASK [debops.pki : Ensure that sensitive files are excluded from version control] ***

fatal: [data]: FAILED! => {"changed": true, "failed": true, "msg": "Destination directory /etc/pki does not exist"}

fatal: [www]: FAILED! => {"changed": true, "failed": true, "msg": "Destination directory /etc/pki does not exist"}

hosts:

control: OSX 10.11.6

data: ubuntu/trusty64 vagrant

www: debian/jessie64 vagrant

--