Minimal test case demonstrating interpolation of complex variables within a host_vars file.

configure.yml

#!/bin/env ansible-playbook

- name: configure postgres
  hosts: localhost
  connection: local
  tasks:
    - name: configure pg_hba.conf
      template: src=pg_hba.conf.j2 dest=./pg_hba.conf

hosts

localahost

localhost under host_vars

group_A_ipaddrs:
   - 192.168.1.201

databases:
  old_style:
    user:  service
    pass:  'secret'
    allow: $group_A_ipaddrs

  new_style:
    user:  service
    pass:  'secret'
    allow: '{{ group_A_ipaddrs }}'

pg_hba.conf-at-0568abe

hostssl new_style service [/32 md5
hostssl new_style service '/32 md5
hostssl new_style service 1/32 md5
hostssl new_style service 9/32 md5
hostssl new_style service 2/32 md5
hostssl new_style service ./32 md5
hostssl new_style service 1/32 md5
hostssl new_style service 6/32 md5
hostssl new_style service 8/32 md5
hostssl new_style service ./32 md5
hostssl new_style service 1/32 md5
hostssl new_style service ./32 md5
hostssl new_style service 2/32 md5
hostssl new_style service 0/32 md5
hostssl new_style service 1/32 md5
hostssl new_style service '/32 md5
hostssl new_style service ]/32 md5

hostssl old_style service 192.168.1.201/32 md5

pg_hba.conf-at-3722beb

hostssl new_style service {/32 md5
hostssl new_style service {/32 md5
hostssl new_style service g/32 md5
hostssl new_style service r/32 md5
hostssl new_style service o/32 md5
hostssl new_style service u/32 md5
hostssl new_style service p/32 md5
hostssl new_style service _/32 md5
hostssl new_style service A/32 md5
hostssl new_style service _/32 md5
hostssl new_style service i/32 md5
hostssl new_style service p/32 md5
hostssl new_style service a/32 md5
hostssl new_style service d/32 md5
hostssl new_style service d/32 md5
hostssl new_style service r/32 md5
hostssl new_style service s/32 md5
hostssl new_style service }/32 md5
hostssl new_style service }/32 md5

hostssl old_style service $/32 md5
hostssl old_style service g/32 md5
hostssl old_style service r/32 md5
hostssl old_style service o/32 md5
hostssl old_style service u/32 md5
hostssl old_style service p/32 md5
hostssl old_style service _/32 md5
hostssl old_style service A/32 md5
hostssl old_style service _/32 md5
hostssl old_style service i/32 md5
hostssl old_style service p/32 md5
hostssl old_style service a/32 md5
hostssl old_style service d/32 md5
hostssl old_style service d/32 md5
hostssl old_style service r/32 md5
hostssl old_style service s/32 md5

pg_hba.conf.j2

{% for item in databases|dictsort %}

    {%- if item.1.allow is defined %}

        {%- for ipaddr in item.1.allow %}

hostssl {{ item.0 }} {{ item.1.user }} {{ ipaddr }}/32 md5       

        {%- endfor %}

    {%- endif %}

{% endfor %}