Playbook needed for IPSec management

[KellerFuchs]

I would like to propose a way to setup IPSec in transport mode between all our machines, because:

• we can ;)
• it makes sure that communication between our boxes is authenticated and encrypted (I haven't reviewed the TLS settings for everything, and that would be a daunting task...)
• it hides some communication metadata (protocol & port).

However, managing a full mesh by hand is not going to be fun, so we should have a playbook that:

• fetches the IPSec pubkeys, and make the server generate keys if needed;
• sends the pubkeys to all servers (or as a hash in the config?);
• generate the StrongSwan config from a template;
• reloads.