From 5d308dce5e9f364b92ae1c7340ad4e1995c3fdc5 Mon Sep 17 00:00:00 2001
From: Jordan Holt <jordan@vimium.com>
Date: Mon, 10 Mar 2025 16:05:10 +0000
Subject: [PATCH] coturn: move out of module

---
 hosts/vps1/coturn.nix             | 117 ++++++++++++++++++++++++++
 hosts/vps1/default.nix            |   6 +-
 modules/nixos/services/coturn.nix | 135 ------------------------------
 3 files changed, 118 insertions(+), 140 deletions(-)
 create mode 100644 hosts/vps1/coturn.nix
 delete mode 100644 modules/nixos/services/coturn.nix

diff --git a/hosts/vps1/coturn.nix b/hosts/vps1/coturn.nix
new file mode 100644
index 0000000..a845f61
--- /dev/null
+++ b/hosts/vps1/coturn.nix
@@ -0,0 +1,117 @@
+{
+  config,
+  lib,
+  self,
+  ...
+}:
+
+let
+  realm = "turn.vimium.com";
+  matrixIntegration = true;
+in
+{
+  networking.firewall =
+    let
+      range =
+        with config.services.coturn;
+        lib.singleton {
+          from = min-port;
+          to = max-port;
+        };
+    in
+    {
+      allowedTCPPorts = [
+        3478 # TURN listener
+        5349 # STUN TLS
+        5350 # STUN TLS alt
+      ];
+      allowedUDPPorts = [
+        3478 # TURN listener
+        5349 # TLS
+        5350 # TLS alt
+      ];
+      allowedUDPPortRanges = range; # TURN peer relays
+    };
+
+  security.acme.certs = {
+    "${config.services.coturn.realm}" = {
+      group = "turnserver";
+      reloadServices = [ "coturn" ];
+    };
+  };
+
+  age.secrets =
+    {
+      "passwords/services/coturn/static-auth-secret" = {
+        file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
+        owner = "turnserver";
+        group = "turnserver";
+      };
+    }
+    // (
+      if matrixIntegration then
+        {
+          "passwords/services/coturn/matrix-turn-config.yml" = {
+            file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
+            owner = "matrix-synapse";
+            group = "matrix-synapse";
+          };
+        }
+      else
+        { }
+    );
+
+  services.coturn = rec {
+    enable = true;
+    realm = realm;
+    use-auth-secret = true;
+    static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
+    cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    min-port = 49000;
+    max-port = 50000;
+    no-cli = true;
+    no-tcp-relay = true;
+    extraConfig = ''
+      cipher-list="HIGH"
+      no-multicast-peers
+
+      # Ban private CIDR blocks
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  services.matrix-synapse = lib.mkIf matrixIntegration {
+    settings = with config.services.coturn; {
+      turn_uris = [
+        "turn:${realm}:3478?transport=udp"
+        "turn:${realm}:3478?transport=tcp"
+      ];
+      turn_user_lifetime = "1h";
+    };
+    extraConfigFiles = [
+      config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
+    ];
+  };
+}
diff --git a/hosts/vps1/default.nix b/hosts/vps1/default.nix
index 238cc3d..f6bda0b 100644
--- a/hosts/vps1/default.nix
+++ b/hosts/vps1/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ./hardware-configuration.nix
+    ./coturn.nix
     ./gitea.nix
     ./headscale.nix
     ./kanidm.nix
@@ -63,11 +64,6 @@
         ];
         repoPath = "ssh://p91y8oh7@p91y8oh7.repo.borgbase.com/./repo";
       };
-      coturn = {
-        enable = true;
-        realm = "turn.vimium.com";
-        matrixIntegration = true;
-      };
       nginx.enable = true;
       postgresql.enable = true;
     };
diff --git a/modules/nixos/services/coturn.nix b/modules/nixos/services/coturn.nix
deleted file mode 100644
index 64dab95..0000000
--- a/modules/nixos/services/coturn.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}:
-
-let
-  cfg = config.modules.services.coturn;
-in
-{
-  options.modules.services.coturn = {
-    enable = lib.mkOption {
-      default = false;
-      example = true;
-    };
-    realm = lib.mkOption {
-      type = lib.types.str;
-      description = "The realm to be used by the TURN server.";
-      example = "turn.vimium.com";
-    };
-    matrixIntegration = lib.mkOption {
-      default = false;
-      description = "Configure the matrix-synapse module to use this TURN server.";
-      example = true;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    networking.firewall =
-      let
-        range =
-          with config.services.coturn;
-          lib.singleton {
-            from = min-port;
-            to = max-port;
-          };
-      in
-      {
-        allowedTCPPorts = [
-          3478 # TURN listener
-          5349 # STUN TLS
-          5350 # STUN TLS alt
-        ];
-        allowedUDPPorts = [
-          3478 # TURN listener
-          5349 # TLS
-          5350 # TLS alt
-        ];
-        allowedUDPPortRanges = range; # TURN peer relays
-      };
-
-    security.acme.certs = {
-      "${config.services.coturn.realm}" = {
-        group = "turnserver";
-        reloadServices = [ "coturn" ];
-      };
-    };
-
-    age.secrets =
-      {
-        "passwords/services/coturn/static-auth-secret" = {
-          file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
-          owner = "turnserver";
-          group = "turnserver";
-        };
-      }
-      // (
-        if cfg.matrixIntegration then
-          {
-            "passwords/services/coturn/matrix-turn-config.yml" = {
-              file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
-              owner = "matrix-synapse";
-              group = "matrix-synapse";
-            };
-          }
-        else
-          { }
-      );
-
-    services.coturn = rec {
-      enable = true;
-      realm = cfg.realm;
-      use-auth-secret = true;
-      static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
-      cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
-      pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
-      min-port = 49000;
-      max-port = 50000;
-      no-cli = true;
-      no-tcp-relay = true;
-      extraConfig = ''
-        cipher-list="HIGH"
-        no-multicast-peers
-
-        # Ban private CIDR blocks
-        denied-peer-ip=0.0.0.0-0.255.255.255
-        denied-peer-ip=10.0.0.0-10.255.255.255
-        denied-peer-ip=100.64.0.0-100.127.255.255
-        denied-peer-ip=127.0.0.0-127.255.255.255
-        denied-peer-ip=169.254.0.0-169.254.255.255
-        denied-peer-ip=172.16.0.0-172.31.255.255
-        denied-peer-ip=192.0.0.0-192.0.0.255
-        denied-peer-ip=192.0.2.0-192.0.2.255
-        denied-peer-ip=192.88.99.0-192.88.99.255
-        denied-peer-ip=192.168.0.0-192.168.255.255
-        denied-peer-ip=198.18.0.0-198.19.255.255
-        denied-peer-ip=198.51.100.0-198.51.100.255
-        denied-peer-ip=203.0.113.0-203.0.113.255
-        denied-peer-ip=240.0.0.0-255.255.255.255
-        denied-peer-ip=::1
-        denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
-        denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
-        denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
-        denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-        denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-      '';
-    };
-
-    services.matrix-synapse = lib.mkIf cfg.matrixIntegration {
-      settings = with config.services.coturn; {
-        turn_uris = [
-          "turn:${realm}:3478?transport=udp"
-          "turn:${realm}:3478?transport=tcp"
-        ];
-        turn_user_lifetime = "1h";
-      };
-      extraConfigFiles = [
-        config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
-      ];
-    };
-  };
-}