Block a user
Split extras and ngnix out of the main playbook
Make sso config template more readable
Only restart extras being changed, not all
also needs to restart synapse if appservice registration changed
Only restart extras being changed, not all