Implement MSC1957: Integration manager discovery

Render vhost directives in https server block

https://github.com/matrix-org/matrix-doc/pull/1957

Yay Riot iOS now supports integration manager discovery!

Allow Synapse manhole to be enabled

Can you double check that the way I have this set only exposes it locally? It is important that the manhole is not available to the outside world since it is quite powerful and the password is hard coded.

Add telegram relay bot feature to playbook

Switch riot-web image (bubuntux/riot-web -> vectorim/riot-web)

Switching to the official image (vectorim/riot-web) should ensure:
- there's less breakage, as it's maintained by the same team as riot-web
- there's fewer actors we need to trust
- we can upgrade riot-web faster, as newer versions should be released
on Docker hub at the same time riot-web releases are made

Update riot-web (1.5.3 -> 1.5.4)

Update postgres & nginx

Remove identity server section from .well-known/matrix/client if there is no identity server

Riot used to be fine with it being blank but now it complains. This creates an ugly looking comma when there is an identity server configured but I guess that's fine.

Refactor setup server base

We've just updated it in the task above, so it's unnecessary

We've just updated it in the task above, so it's unnecessary

Fix: Restrict a Debian-specific task to Debian OS.

Since commit b9753635 the task 'Ensure docker-ce is installed (Debian)' fails with an error on CentOS although it should not even run on this OS.

Don't install docker-ce if docker.io is installed

Update certbot (0.38.0 -> 0.40.1)

Prompted by: https://matrix.org/blog/2019/11/09/avoiding-unwelcome-visitors-on-private-matrix-servers

This is a bit controversial, because.. the Synapse default remains open,
while the general advice (as per the blog post) is to make it more private.

I'm not sure exactly what kind of server people set up and whether they
want to make the room directory public. Our general goal is to favor
privacy and security when running personal (family & friends) and corporate
homeservers, both of which likely benefit from having a more secure default.

Don't mention systemd-journald adjustment anymore, because
we've changed log levels to WARNING and Synapse is not chatty by default
anymore.

The "excessive log messages may get dropped on CentOS" issue no longer
applies to most users and we shouldn't bother them with it.

Replace constructs appending elements with variables to matrix_synapse_container_extra_arguments

Removed a set_facts that I have used for tracing down the issue

Upgrade riot-web (1.5.2 -> 1.5.3)

Mention that ARM is not supported