roles/dch-proxy: Deploy reverse HTTP/HTTPS proxy

The *dch-proxy* role sets up HAProxy to provide a revers proxy for all
public-facing web services on the Pyrocufflink network. It uses the TLS
Server Name Indication (SNI) extension to determine the proper backend
server based on the name requested by the client.

For now, only Gitea is configured; the name *git.pyrocufflink.blue* is
proxied to *git0.pyrocufflink.blue*. All other names are proxied to
Myala.

roles/dch-proxy/templates/frontend-main.haproxy.cfg.j2

@@ -0,0 +1,17 @@
+frontend main
+    bind :::80
+
+    use_backend gitea if { hdr(host) -i git.pyrocufflink.blue }
+    default_backend myala
+
+
+frontend main-tls
+    bind :::443
+    mode tcp
+    option tcplog
+
+    tcp-request inspect-delay 5s
+    tcp-request content accept if { req_ssl_hello_type 1 }
+
+    use_backend gitea-tls if { req_ssl_sni -i git.pyrocufflink.blue }
+    default_backend myala-tls