Firewall allowance for new SSH port should be made _before_ changing the port, not after #9
Description
Title kinda says it all. Took me a bit to figure out why the VPSes I was spinning up to experiment with this playbook were ending up unreachable halfway through the process!
Generally speaking, it looks like the roles could use a solid "make sure this can be canceled at any step in the process and then be safely resumed" pass - Ansible communities seem big on idempotency, for reasons that kinda make sense if you think about it.