coturn: move out of module
This commit is contained in:
parent
c0c435c2da
commit
5d308dce5e
GPG Key ID:
B8CFFF61F1CCF520
117
hosts/vps1/coturn.nix
Normal file
117
hosts/vps1/coturn.nix
Normal file
@ -0,0 +1,117 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
realm = "turn.vimium.com";
|
||||
matrixIntegration = true;
|
||||
in
|
||||
{
|
||||
networking.firewall =
|
||||
let
|
||||
range =
|
||||
with config.services.coturn;
|
||||
lib.singleton {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
};
|
||||
in
|
||||
{
|
||||
allowedTCPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # STUN TLS
|
||||
5350 # STUN TLS alt
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # TLS
|
||||
5350 # TLS alt
|
||||
];
|
||||
allowedUDPPortRanges = range; # TURN peer relays
|
||||
};
|
||||
|
||||
security.acme.certs = {
|
||||
"${config.services.coturn.realm}" = {
|
||||
group = "turnserver";
|
||||
reloadServices = [ "coturn" ];
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets =
|
||||
{
|
||||
"passwords/services/coturn/static-auth-secret" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
|
||||
owner = "turnserver";
|
||||
group = "turnserver";
|
||||
};
|
||||
}
|
||||
// (
|
||||
if matrixIntegration then
|
||||
{
|
||||
"passwords/services/coturn/matrix-turn-config.yml" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
}
|
||||
else
|
||||
{ }
|
||||
);
|
||||
|
||||
services.coturn = rec {
|
||||
enable = true;
|
||||
realm = realm;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
|
||||
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||
min-port = 49000;
|
||||
max-port = 50000;
|
||||
no-cli = true;
|
||||
no-tcp-relay = true;
|
||||
extraConfig = ''
|
||||
cipher-list="HIGH"
|
||||
no-multicast-peers
|
||||
|
||||
# Ban private CIDR blocks
|
||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||
denied-peer-ip=::1
|
||||
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
|
||||
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
|
||||
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
'';
|
||||
};
|
||||
|
||||
services.matrix-synapse = lib.mkIf matrixIntegration {
|
||||
settings = with config.services.coturn; {
|
||||
turn_uris = [
|
||||
"turn:${realm}:3478?transport=udp"
|
||||
"turn:${realm}:3478?transport=tcp"
|
||||
];
|
||||
turn_user_lifetime = "1h";
|
||||
};
|
||||
extraConfigFiles = [
|
||||
config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
|
||||
];
|
||||
};
|
||||
}
|
||||
@ -6,6 +6,7 @@
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./coturn.nix
|
||||
./gitea.nix
|
||||
./headscale.nix
|
||||
./kanidm.nix
|
||||
@ -63,11 +64,6 @@
|
||||
];
|
||||
repoPath = "ssh://p91y8oh7@p91y8oh7.repo.borgbase.com/./repo";
|
||||
};
|
||||
coturn = {
|
||||
enable = true;
|
||||
realm = "turn.vimium.com";
|
||||
matrixIntegration = true;
|
||||
};
|
||||
nginx.enable = true;
|
||||
postgresql.enable = true;
|
||||
};
|
||||
|
||||
@ -1,135 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
self,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.modules.services.coturn;
|
||||
in
|
||||
{
|
||||
options.modules.services.coturn = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
example = true;
|
||||
};
|
||||
realm = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "The realm to be used by the TURN server.";
|
||||
example = "turn.vimium.com";
|
||||
};
|
||||
matrixIntegration = lib.mkOption {
|
||||
default = false;
|
||||
description = "Configure the matrix-synapse module to use this TURN server.";
|
||||
example = true;
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall =
|
||||
let
|
||||
range =
|
||||
with config.services.coturn;
|
||||
lib.singleton {
|
||||
from = min-port;
|
||||
to = max-port;
|
||||
};
|
||||
in
|
||||
{
|
||||
allowedTCPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # STUN TLS
|
||||
5350 # STUN TLS alt
|
||||
];
|
||||
allowedUDPPorts = [
|
||||
3478 # TURN listener
|
||||
5349 # TLS
|
||||
5350 # TLS alt
|
||||
];
|
||||
allowedUDPPortRanges = range; # TURN peer relays
|
||||
};
|
||||
|
||||
security.acme.certs = {
|
||||
"${config.services.coturn.realm}" = {
|
||||
group = "turnserver";
|
||||
reloadServices = [ "coturn" ];
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets =
|
||||
{
|
||||
"passwords/services/coturn/static-auth-secret" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
|
||||
owner = "turnserver";
|
||||
group = "turnserver";
|
||||
};
|
||||
}
|
||||
// (
|
||||
if cfg.matrixIntegration then
|
||||
{
|
||||
"passwords/services/coturn/matrix-turn-config.yml" = {
|
||||
file = "${self.inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
|
||||
owner = "matrix-synapse";
|
||||
group = "matrix-synapse";
|
||||
};
|
||||
}
|
||||
else
|
||||
{ }
|
||||
);
|
||||
|
||||
services.coturn = rec {
|
||||
enable = true;
|
||||
realm = cfg.realm;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
|
||||
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
|
||||
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
|
||||
min-port = 49000;
|
||||
max-port = 50000;
|
||||
no-cli = true;
|
||||
no-tcp-relay = true;
|
||||
extraConfig = ''
|
||||
cipher-list="HIGH"
|
||||
no-multicast-peers
|
||||
|
||||
# Ban private CIDR blocks
|
||||
denied-peer-ip=0.0.0.0-0.255.255.255
|
||||
denied-peer-ip=10.0.0.0-10.255.255.255
|
||||
denied-peer-ip=100.64.0.0-100.127.255.255
|
||||
denied-peer-ip=127.0.0.0-127.255.255.255
|
||||
denied-peer-ip=169.254.0.0-169.254.255.255
|
||||
denied-peer-ip=172.16.0.0-172.31.255.255
|
||||
denied-peer-ip=192.0.0.0-192.0.0.255
|
||||
denied-peer-ip=192.0.2.0-192.0.2.255
|
||||
denied-peer-ip=192.88.99.0-192.88.99.255
|
||||
denied-peer-ip=192.168.0.0-192.168.255.255
|
||||
denied-peer-ip=198.18.0.0-198.19.255.255
|
||||
denied-peer-ip=198.51.100.0-198.51.100.255
|
||||
denied-peer-ip=203.0.113.0-203.0.113.255
|
||||
denied-peer-ip=240.0.0.0-255.255.255.255
|
||||
denied-peer-ip=::1
|
||||
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
|
||||
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
|
||||
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
'';
|
||||
};
|
||||
|
||||
services.matrix-synapse = lib.mkIf cfg.matrixIntegration {
|
||||
settings = with config.services.coturn; {
|
||||
turn_uris = [
|
||||
"turn:${realm}:3478?transport=udp"
|
||||
"turn:${realm}:3478?transport=tcp"
|
||||
];
|
||||
turn_user_lifetime = "1h";
|
||||
};
|
||||
extraConfigFiles = [
|
||||
config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user