on second thought, use a second container for NGINX proxy
remove obsolete roles dir