Store Gitea data (avatars, attachments, etc.) in Garage/S3

Also adds a new garage gateway role, which only allows RPC (inter-node)
traffic to Garage.

site-cookbooks/kosmos_garage/recipes/firewall_apis.rb

@@ -7,13 +7,6 @@ firewall_rule 'garage_s3_api' do
   port     node['garage']['s3_api_port']
 end
 
-firewall_rule 'garage_rpc' do
-  command  :allow
-  protocol :tcp
-  source   "10.1.1.0/24"
-  port     node['garage']['rpc_port']
-end
-
 firewall_rule 'garage_s3_web' do
   command  :allow
   protocol :tcp
@@ -28,9 +21,14 @@ firewall_rule 'garage_admin' do
   port     node['garage']['admin_port']
 end
 
-firewall_rule 'garage_k2v_api' do
-  command  :allow
-  protocol :tcp
-  source   "10.1.1.0/24"
-  port     node['garage']['k2v_api_port']
-end
+# K2V is currently disabled by default in release
+# builds, but may be interesting for RS usage:
+#
+# https://garagehq.deuxfleurs.fr/documentation/reference-manual/k2v/
+#
+# firewall_rule 'garage_k2v_api' do
+#   command  :allow
+#   protocol :tcp
+#   source   "10.1.1.0/24"
+#   port     node['garage']['k2v_api_port']
+# end

site-cookbooks/kosmos_garage/recipes/firewall_rpc.rb

@@ -0,0 +1,8 @@
+include_recipe 'firewall'
+
+firewall_rule 'garage_rpc' do
+  command  :allow
+  protocol :tcp
+  source   "10.1.1.0/24"
+  port     node['garage']['rpc_port']
+end