Lots of updates to the README/INSTALL.md.

Fixes #4601.

If TLS is disabled, it should not be an error if no cert is given.

Fixes #4554.

Remove redundant entries from docker config

Infer no_tls from presence of TLS listeners

* no_tls is now redundant (#4613)
* we don't need a dummy cert any more (#4618)

Rather than have to specify `no_tls` explicitly, infer whether we need to load
the TLS keys etc from whether we have any TLS-enabled listeners.

we aren't going to use them anyway.

... otherwise we would fail with a mysterious KeyError or something later.

Log which file we're reading keys and certs from, and refactor the code a bit
in preparation for other work

It's nothing to do with refreshing the certificates. No idea why it was here.

add updating of backup versions

Rearrange the comments to try to clarify them, and expand on what some of it
means.

Use a sensible default 'bind_addresses' setting.

For the insecure port, only bind to localhost, and enable x_forwarded, since
apparently it's for use behind a load-balancer.

Factor out the reverse proxy info to a separate file, add some more info on
reverse-proxying the federation port.

New listener resource for the federation API "openid/userinfo" endpoint

* Allow "unavailable" presence status for /sync

Closes #3772, closes #3779

Signed-off-by: Valentin Anger <valentin.an.1999@gmail.com>

* Add changelog for PR 4592

Add more tables to the list of tables which need a background update to
complete before we can upsert into them, which fixes a race against the
background updates.

also add tests

A surprising number of people are using the well-known method, and are
simply copying the example configuration. This is problematic as the
example includes an explicit port, which causes inbound federation
requests to have the HTTP Host header include the port, upsetting some
reverse proxies.

Given that, we update the well-known example to be more explicit about
the various ways you can set it up, and the consequence of using an
explict port.

A surprising number of people are using the well-known method, and are
simply copying the example configuration. This is problematic as the
example includes an explicit port, which causes inbound federation
requests to have the HTTP Host header include the port, upsetting some
reverse proxies.

Given that, we update the well-known example to be more explicit about
the various ways you can set it up, and the consequence of using an
explict port.