We have an internal Ansible role for this. Migrate it to here and ensure it's suitable for general use.