dom0-bootstrap.yml -> we have a part of this, but we should verify we aren't missing anything

[aagbsn]

roles that we might need to migrate:
ooca-cert which is used by legacy hosts ams-slack-1.ooni.org, doams1-countly.ooni.nu, mia-echoth.ooni.nu, mia-httpth.ooni.nu for prometheus; other hosts use their public certificates for monitoring.