1 - the two bugs web hosts handle /srv/bugs.debian.org/cache/libravatar
2 differently. Figure out which is best and move the definition to bugs_web.
3 - modules/roles/templates/sso_rp/ca.crl.erb hardcodes the sso master name.
4 Probably want to store/collect the CRL?