Integrate coturn module with matrix-synapse

flake.lock

@@ -595,11 +595,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1717248946,
+        "lastModified": 1720459643,
-        "narHash": "sha256-8dFjsjkTbKClYK5Bg1KKdMx5wrp5AOTLsu3Jv9otoVw=",
+        "narHash": "sha256-X71/NplPXPe9pCvrd9ELpnYBEYtju4+x3LA7S5I1GXM=",
         "ref": "refs/heads/master",
-        "rev": "bff76a71201dda856c91dc5b5bdc3859f53c29f2",
+        "rev": "f8d68b934f4380ecbc6365b4ef7f7c632833d1aa",
-        "revCount": 20,
+        "revCount": 21,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },

hosts/vps1/default.nix

@@ -1,4 +1,7 @@
-{ config, lib, pkgs, inputs, ... }:
+{
+  lib,
+  ...
+}:
 
 {
   imports = [
@@ -51,7 +54,11 @@
         ];
         repoPath = "ssh://p91y8oh7@p91y8oh7.repo.borgbase.com/./repo";
       };
-      coturn.enable = true;
+      coturn = {
+        enable = true;
+        realm = "turn.vimium.com";
+        matrixIntegration = true;
+      };
       gitea.enable = true;
       headscale.enable = true;
       matrix-synapse.enable = true;

modules/services/coturn/default.nix

@@ -1,60 +1,124 @@
-{ config, lib, pkgs, inputs, ... }:
+{
-
+  config,
-with lib;
+  lib,
+  inputs,
+  ...
+}:
 
 let
   cfg = config.modules.services.coturn;
 in {
   options.modules.services.coturn = {
-    enable = mkOption {
+    enable = lib.mkOption {
       default = false;
       example = true;
     };
+    realm = lib.mkOption {
+      type = lib.types.str;
+      description = "The realm to be used by the TURN server.";
+      example = "turn.vimium.com";
+    };
+    matrixIntegration = lib.mkOption {
+      default = false;
+      description = "Configure the matrix-synapse module to use this TURN server.";
+      example = true;
+    };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
-    networking.firewall = {
+    networking.firewall = let
+      range = with config.services.coturn; lib.singleton {
+        from = min-port;
+        to = max-port;
+      };
+    in {
       allowedTCPPorts = [
+        3478  # TURN listener
         5349  # STUN TLS
         5350  # STUN TLS alt
       ];
-      allowedUDPPortRanges = [
+      allowedUDPPorts = [
-        { from = 49152; to = 49999; } # TURN relay
+        3478  # TURN listener
+        5349  # TLS
+        5350  # TLS alt
       ];
+      allowedUDPPortRanges = range; # TURN peer relays
     };
 
     security.acme.certs = {
-      "turn.vimium.com" = {
+      "${config.services.coturn.realm}" = {
+        group = "turnserver";
         reloadServices = [ "coturn" ];
       };
     };
 
-    age.secrets."passwords/services/coturn/shared-secret" = {
+    age.secrets = {
-      file = "${inputs.secrets}/passwords/services/coturn/shared-secret.age";
+      "passwords/services/coturn/static-auth-secret" = {
+        file = "${inputs.secrets}/passwords/services/coturn/static-auth-secret.age";
         owner = "turnserver";
         group = "turnserver";
       };
+    } // (if cfg.matrixIntegration then {
+      "passwords/services/coturn/matrix-turn-config.yml" = {
+        file = "${inputs.secrets}/passwords/services/coturn/matrix-turn-config.yml.age";
+        owner = "matrix-synapse";
+        group = "matrix-synapse";
+      };
+    } else {});
 
-    services.coturn = {
+    services.coturn = rec {
       enable = true;
-      lt-cred-mech = true;
+      realm = cfg.realm;
       use-auth-secret = true;
-      static-auth-secret-file = config.age.secrets."passwords/services/coturn/shared-secret".path;
+      static-auth-secret-file = config.age.secrets."passwords/services/coturn/static-auth-secret".path;
-      realm = "turn.vimium.com";
+      cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
-      relay-ips = [
+      pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
-        "198.244.190.160"
+      min-port = 49000;
-      ];
+      max-port = 50000;
+      no-cli = true;
       no-tcp-relay = true;
       extraConfig = ''
         cipher-list="HIGH"
         no-loopback-peers
         no-multicast-peers
+
+        # Ban private CIDR blocks
+        denied-peer-ip=0.0.0.0-0.255.255.255
+        denied-peer-ip=10.0.0.0-10.255.255.255
+        denied-peer-ip=100.64.0.0-100.127.255.255
+        denied-peer-ip=127.0.0.0-127.255.255.255
+        denied-peer-ip=169.254.0.0-169.254.255.255
+        denied-peer-ip=172.16.0.0-172.31.255.255
+        denied-peer-ip=192.0.0.0-192.0.0.255
+        denied-peer-ip=192.0.2.0-192.0.2.255
+        denied-peer-ip=192.88.99.0-192.88.99.255
+        denied-peer-ip=192.168.0.0-192.168.255.255
+        denied-peer-ip=198.18.0.0-198.19.255.255
+        denied-peer-ip=198.51.100.0-198.51.100.255
+        denied-peer-ip=203.0.113.0-203.0.113.255
+        denied-peer-ip=240.0.0.0-255.255.255.255
+        denied-peer-ip=::1
+        denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+        denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+        denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+        denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+        denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+        denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+        denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
       '';
-      secure-stun = true;
+    };
-      cert = "/var/lib/acme/turn.vimium.com/fullchain.pem";
+
-      pkey = "/var/lib/acme/turn.vimium.com/key.pem";
+    services.matrix-synapse = lib.mkIf cfg.matrixIntegration {
-      min-port = 49152;
+      settings = with config.services.coturn; {
-      max-port = 49999;
+        turn_uris = [
+          "turn:${realm}:3478?transport=udp"
+          "turn:${realm}:3478?transport=tcp"
+        ];
+        turn_user_lifetime = "1h";
+      };
+      extraConfigFiles = [
+        config.age.secrets."passwords/services/coturn/matrix-turn-config.yml".path
+      ];
     };
   };
 }

modules/services/matrix-synapse/default.nix

@@ -1,6 +1,10 @@
-{ config, lib, pkgs, inputs, ... }:
+{
-
+  config,
-with lib;
+  lib,
+  pkgs,
+  inputs,
+  ...
+}:
 
 let
   cfg = config.modules.services.matrix-synapse;
@@ -18,13 +22,13 @@ let
   '';
 in {
   options.modules.services.matrix-synapse = {
-    enable = mkOption {
+    enable = lib.mkOption {
       default = false;
       example = true;
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [
       8448 # Matrix federation
     ];
@@ -112,15 +116,11 @@ in {
       enable = true;
       settings = {
         database.name = "sqlite3";
+        enable_metrics = false;
         enable_registration = false;
+        max_upload_size = "100M";
+        report_stats = false;
         server_name = "vimium.com";
-        # turn_shared_secret = "???";
-        # turn_uris = [
-        #   "turn:turn.vimium.com:5349?transport=udp"
-        #   "turn:turn.vimium.com:5350?transport=udp"
-        #   "turn:turn.vimium.com:5349?transport=tcp"
-        #   "turn:turn.vimium.com:5350?transport=tcp"
-        # ];
       };
     };
   };