This GitLab instance and the rest of the school's online services will be unavailable from August 4th to August 10th. Read the Forge announcement in the news.
cri.acme.acme_vault_upload role needs existing acme user and group, which are created in cri.acme.acme. Thus running the latter first would avoid having error when deploying playbook on brand new machine.