Hi,
Yes, you can run everything on one server.
When you exempt a server, you enroll it with a long-lived health certificate, called an "exemption certificate." This will allow the server to participate in IPsec. If the server is functioning as an HRA, then it will need to be in the boundary zone with a policy to request (not require) authentication. Since boundary servers are accessible by noncompliant and non-NAP capable devices, if the server is a domain controller you should make it read-only.
-Greg
