Generate per-site SSL intermediate CA, fix cred/pki paths

Change-Id: I0bda0791d82142acac8c6af0e152d8d0954ef719
diff --git a/roles/create-lxd/templates/ansible_hosts.j2 b/roles/create-lxd/templates/ansible_hosts.j2
index e2e58de..21f5c8a 100644
--- a/roles/create-lxd/templates/ansible_hosts.j2
+++ b/roles/create-lxd/templates/ansible_hosts.j2
@@ -3,20 +3,27 @@
 
 # VMs will go away shortly in favor of containers
 [vms]
+{% if head_vm_list is defined -%}
 {% for vm in head_vm_list -%}
 {{ vm.name }}
 {% endfor -%}
+{% endif -%}
 
 [containers]
+{% if head_lxd_list is defined -%}
 {% for lxd in head_lxd_list -%}
 {{ lxd.name }}
 {% endfor -%}
+{% endif -%}
 
 [services:children]
 vms
 containers
 
 [docker]
+{% if head_vm_list is defined -%}
 {% for vm in head_vm_list | selectattr('docker_path', 'defined') -%}
 {{ vm.name }}
 {% endfor -%}
+{% endif -%}
+