This is slight hack that I want to fix in the future. It is motivated by
the fact that the certbot certificate is valid for all domains that are
requested, instead of a certificate-per-domain.
This role installs a distribution-provided nginx and does some basic
configuration on it. It acts as a reverse proxy for the containers
that does the TLS offloading and provides an optional HTTP basic
authentication page for services that aren't ready to be exposed yet.
