This may proof useful to someone in the future.

We've had it on `matrix-nginx-proxy` before, but
our initial support for Traefik did not include any of these security
headers.

Previously, we had to run it at a subpath, like `/synapse-admin`.

We can now dedicate a whole domain and the `/` path to it, should we
wish to do so.

Previously, it had to go through matrix-nginx-proxy.
It's exposed to Traefik directly via container labels now.

This paves the way for installing other roles into `roles/galaxy` using `ansible-galaxy`,
similar to how it's done in:

- https://github.com/spantaleev/gitea-docker-ansible-deploy
- https://github.com/spantaleev/nextcloud-docker-ansible-deploy

In the near future, we'll be removing a lot of the shared role code from here
and using upstream roles for it. Some of the core `matrix-*` roles have
already been extracted out into other reusable roles:

- https://github.com/devture/com.devture.ansible.role.postgres
- https://github.com/devture/com.devture.ansible.role.systemd_docker_base
- https://github.com/devture/com.devture.ansible.role.timesync
- https://github.com/devture/com.devture.ansible.role.vars_preserver
- https://github.com/devture/com.devture.ansible.role.playbook_runtime_messages
- https://github.com/devture/com.devture.ansible.role.playbook_help

We just need to migrate to those.