move all host- and group vars to setup, replace provisioning with generic version
don't regenerate certs for each make run
use ``$http_host`` because otherwise the port is omitted and proxying breaks