websites/proxy-matrix: Add Synapse rev proxy setup

The *websites/proxy-matrix* role configures the Internet-facing reverse
proxy to handle the *hatch.chat* domain.  Most Matrix communication
happens over the default HTTPS port, and as such will be directed
through the reverse proxy.

websites.yml

@@ -35,6 +35,16 @@
     tags:
     - websites/proxy
     - websites/proxy-openvpn
+  - role: cert
+    cert_src: websites/hatch.chat.cer
+    cert_dest: /etc/pki/tls/certs/hatch.chat.cer
+    cert_key_src: websites/hatch.chat.key
+    cert_key_dest: /etc/pki/tls/private/hatch.chat.key
+    tags: websites/hatch.chat
+  - role: websites/proxy-matrix
+    tags:
+    - websites/proxy
+    - websites/hatch.chat
   tasks:
   - name: ensure httpd service is running
     service: