I’m not familiar with the UNENCRYPTED_CFG_DIR variable, but it seems to be related to encryption/decription of app configuration and looks like something that’s mostly used by edX internally. There’s some info in this PR.
The edx_service_decrypt_config_enabled variable that controls this is set to false by default. Are you setting it to true in your config?
It looks like you are trying to apply the nginx role alone using custom playbook or run_role playbook. The templates in nginx roles has implicit dependencies on other roles. You could try to include edxapp and forum roles to your playbook without rolling them out. Like this:
tasks:
- name: edxapp fake dep
import_role:
name: edxapp
when: False
- name: forum fake dep
import_role:
name: forum
when: False
- name: deploy nginx
import_role:
name: nginx