GLOCONF_* is really SERVCONF_*.
Source firewall variables from directly within private-data.
Install firewall instead of asking to install it.
update/simplify variables in the fabfile.