I want to keep using self-signed certs (my server is only reachable internally and I do not want to expose it to the internet). And the new server they use (I forgot which) didn't really have that option.

If you have your own domain name, you can get Let's Encrypt certificates for internal servers by using DNS challenges instead of HTTP challenges. I use subdomains like whatever.int.example.com for my internal systems.

Of course, it's possible that the Ansible playbook doesn't support that...

Thanks for the note about Python and the Debian packages. That's a good point. I'll definitely use the Docker containers.