The targets are named fedora-*, but the directory is /etc/server-role (no fedora); should this be consistent? “Stop wasting our time” is a perfectly acceptable answer :) If we did want this unified, I’d slightly prefer a fedora-less naming (to make this easier on both derived and non-derived distributions).
If we go the route of configuration on first boot, we need to be sure the error handling is workable: unlike simply running a script at (role deploy) time, which can just write to stderr and (exit 1), this is not quite as automatic. How will rolekit find out that the configuration step failed, and why? Perhaps “rolekit would check the status of the unit” (when/triggered by what?), and “the unit must write sufficient information to journal associated with the unit”?
Tangentially, I’d like the configuration submitted to rolekit (/etc/server-roles/setup/$ROLENAME.config) archived on the system post-deploy, to make “throw away local modifications and redeploy” or “what changed on the system since role deployment?” possible. That’s fairly independent from the role packaging spec, though—rolekit can be saving these anywhere else than /etc/server-roles/setup and the roles don’t need to know about the existence of the archive.
Mirek