security_mirror -> hiera role; part 1