fix squid/dnf ordering problem

ansible/bootstrap.yml

@@ -127,21 +127,35 @@
       that: dnf_repos_password is undefined
       fail_msg: Passwords should not be templated into repofiles during configure, unset 'dnf_repos_password'
     when: appliances_mode == 'configure'
-  - name: Replace system repos with pulp repos 
-    ansible.builtin.include_role:
-      name: dnf_repos
-      tasks_from: set_repos.yml
 
-# --- tasks after here require access to package repos ---
 - hosts: squid
   tags: squid
   gather_facts: yes
   become: yes
   tasks:
+    # - Installing squid requires working dnf repos
+    # - Configuring dnf_repos itself requires working dnf repos to install epel
+    # - Hence do this on squid nodes first in case they are proxying others
+    - name: Replace system repos with pulp repos
+      ansible.builtin.include_role:
+      name: dnf_repos
+      tasks_from: set_repos.yml
+      when: "'dnf_repos' in group_names"
     - name: Configure squid proxy
       import_role:
         name: squid
 
+- hosts: dnf_repos
+  tags: dnf_repos
+  gather_facts: yes
+  become: yes
+  tasks:
+  - name: Replace system repos with pulp repos 
+    ansible.builtin.include_role:
+      name: dnf_repos
+      tasks_from: set_repos.yml
+
+# --- tasks after here require general access to package repos ---
 - hosts: tuned
   tags: tuned
   gather_facts: yes