garage: add reverse proxy for S3 access from outside

TODO: subdomains?

modules/garage.nix

@@ -23,4 +23,15 @@
       };
     };
   };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."s3.infra.newtype.fr" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/".proxyPass = "http://[::1]:3900/";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
 }