vueko/coturn: Manage shared secret with sops

This requires not using the NixOS module, since it does not support
loading it from a file.

machines/fuuko/secrets.yaml

@@ -5,7 +5,7 @@ prometheus-htpasswd: ENC[AES256_GCM,data:eJOWrcTC3YISJJLuQV6sxzD0r8Gr8uoUt48D9sS
 restic-password: ENC[AES256_GCM,data:IVFXmuzzvvqDS0T3P0R5ZMIn2wdkbE1AqwDMkWqMpDdCOVMP4/HhP4jF+tEarq22,iv:Eu6Wspzm0rPl0CuSoYTTLz+MmaEtmwCD57nH2JTBuaA=,tag:tKqt5Z7nF7lLcSsDKS4E3A==,type:str]
 restic-s3: ENC[AES256_GCM,data:VJ/jgYnUSkbsNMb1ciLiCcRVEpuaznsSFf0QkEnPhTRHpFv4Nt0f8ARnNtG5j3iXSIT4+H2+5HWKXEsjhvL85p0XE3xe4h45xGKnvvVO2obF+b/zsMDdceFJtLbcq+APzPBjchYU,iv:W+80GhAvYD/52dNZsNYiEhiLo4dhO8oxkd+GAbk42NU=,tag:Kj9CaGo/xAmYxdoLE/Lo1Q==,type:str]
 synapse-registration-shared-secret: ENC[AES256_GCM,data:lNzK/7QAk4Scv+lNM8bTTKvowI139c4R4Y7Qpq60n8R61aahlxrnWc/PUEOv85Pdx+8IdBOLnV0kp7OQF6tStGBBCOkAicYmnsLoR36DmuDCvTSKVArryV7BrxL8pv0=,iv:ZT9IIF7W0NHqvnU3lPQclVS5uXXK5HIQUzXNYwYFMIo=,tag:a/sUixOlHEvn5ZOINPwQlg==,type:str]
-synapse-turn-shared-secret: ENC[AES256_GCM,data:I5QbouvLvBpjroux5TTi8gIAHeyNb5KXV1g9sbTdqjD4YoMaedHSiC53h+ZMmqNCKor64e6iP58Y6SbMaTfFaEl0CyK2GqfcSBrlHxKj0GSWaopO5kLS,iv:qsfHxHykY+oZOaMGw5Tvq8a6zBUDxH3B5q8QKdT1oSk=,tag:75OOrVtztDsLYeTglKPYCQ==,type:str]
+synapse-turn-shared-secret: ENC[AES256_GCM,data:sAvP4/jVma7Uq9TR4W/zEoJA17Stj75uG+G4niYaQ1tflxRhE+/HfrhMn7whnmpSgXDb/ZPtLfVaW1DCfU2jovz3Y9Ij1kveXar2aAjlPSsSVwTbFmei,iv:S7uVlE2rhK7ta2S/eX+KXBMQyc69onHYjfMNro3OCjM=,tag:rvI299PQ9TVfVzQjgfUKww==,type:str]
 wg-aria-private-key: ENC[AES256_GCM,data:qbxpfNRocrXDbUJ3MwR5WMXX8LB4Vnv9HMXN403ANaBbCLrRTEL9hy93roY=,iv:l2DYXGY1wN1rP2bG/s9uSwRhbvCUm2T6IJy5LKzguqk=,tag:51S+m1P1EtHk1QWEjdUCUA==,type:str]
 wg-home-private-key: ENC[AES256_GCM,data:6l3CgB4qCsPuyYOWuwU2vNiEeC0D1wl6yZvXGGYVsZfYvdPjRz8j5yV7ekQ=,iv:slB/qr+cxi8r7cnTuZAd8CuzWVnvp24Li6A/AnZaFzo=,tag:ynh1Z2+IELAJcgBbHwFC0A==,type:str]
 sops:
@@ -13,8 +13,8 @@ sops:
     gcp_kms: []
     azure_kv: []
     hc_vault: []
-    lastmodified: '2021-04-06T11:40:14Z'
-    mac: ENC[AES256_GCM,data:k9GRiDmXoKFN96NMGHt0rjAMklKIsnFUgWRP7iUQeA5j0uG4lo92KzJCMsHCIicDdF+NnNmEigeXE1eI7iet8K+rAh9x1wO8CiO/5ITsNeCzJO/PsfVxZHL1h9dqirjMkqGvKA//2nocEGv9uT/k6xezriDktBkDbLBIWg3Jfek=,iv:T5mO4IuPqO7jRRhQm2LMoW51D659SL4zVXBHbdt0Qgg=,tag:ahtBYe/18kHpGWHtqeKlAA==,type:str]
+    lastmodified: '2021-04-07T10:20:03Z'
+    mac: ENC[AES256_GCM,data:OzXpColS5Di4qRXSdkV5Ue2FqysF/GYzX9kQcEiAOZaDb9uUoKBs8EakZ4pOfcgug2/v1BIQ0aQ/Xf2uCERJzvj3rC+2Gdng0p9AC1aelEIm3vxo4hliKEG1eo5KlIrroTaQlxb1wXGKDabuy+8P57reVbLNQuM9ioQ5teuSWLk=,iv:VksbYHEVP/5zvGCgFg9e3pegDrxljkosVretlvaa6w0=,tag:mafF7XQFchHrSA2n9mE0BQ==,type:str]
     pgp:
     -   created_at: '2021-04-06T11:27:21Z'
         enc: |

machines/vueko/secrets.yaml

@@ -1,12 +1,13 @@
 murmur-superuser: ENC[AES256_GCM,data:jTVEa1KmbGAIxxFS2/uIlDCnnJTtGmKFZQ==,iv:YJIfcXlgKEwIRzFEY94dgReNjWZqLAqL0Rb6TG4IHIE=,tag:MVzaRkb24QyyNyFCEMwmzQ==,type:str]
 wg-home-private-key: ENC[AES256_GCM,data:/RHNF6Zw6CTWa9ahUhGWRfkR8KIj+HdqUIojA1w6HQBFbZ/+Vo+CcYTYO5I=,iv:2sDH1P3VRjmLw6Ilkq0rw/hossHrNWP5uRvX9yr5fLE=,tag:KIT5GCfXuhg6RjA8+Nmtnw==,type:str]
+turn-static-auth-secret: ENC[AES256_GCM,data:+E3Fa4X9uXg58xB7lukEdWQeW4Wj+gAKt54FSqL80+k3C/R2AGc0BC/ThP2we5lSY/kfz8W1Wk67ExEDthqlCaG84gbRRnkZ2CkFOe3QQGknHx/n,iv:MwxVxQJHiqrps0eKiXl+OxSrL1Zfo3q5zQXOeR0JofA=,tag:EUC+ZOSJMIb4QEHEFvsyZA==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
-    lastmodified: '2021-04-06T11:14:32Z'
-    mac: ENC[AES256_GCM,data:eMx+ls4NHFqKNwW4XmrtVsizbtnASeO38cw3oPeSlvW8NbT8yUZWRxRofhzg3nD3icyGcwhImVMKHgVz5305zwvrjx0D9n+URe733WPcMmfR39G0FfXz+9kob6p5TVruKjL6qTPmyNRD+8E8CvmBmnwPwRW46F5Pvadum2SZJ3c=,iv:zVxvTUJaTx57KAglUkSNzGsxcX0csPU4qYkkLHwl7bs=,tag:a2Al47gGxFm6XubaTAdw9A==,type:str]
+    lastmodified: '2021-04-07T10:20:05Z'
+    mac: ENC[AES256_GCM,data:xfNk5YRfiQSSSxc/br7ncVSdmuDfbHandwXsLDZlIrh3QWc4DjZ1rqCRiLV8XbRntWGywRRwes6iRn2bT0MCXN+ewrcs0HOS2YjT+g8iDf2fsqZAIU34y0aXMwJTYyHyghO/naWGwb3aGAHPfuWbPg3d4xaCHwnej+nMplTkdQs=,iv:QvisjybnpHaoBdc87MPRQuu5JVPMRNV6UX19oOljv3o=,tag:E9d5/Sa5EOvqTxNYk4NxkA==,type:str]
     pgp:
     -   created_at: '2021-04-06T11:13:54Z'
         enc: |

machines/vueko/services/coturn.nix

@@ -1,57 +1,112 @@
+# The NixOS module does not support extending the configuration with secrets.
 { config, lib, pkgs, ... }:
 let
-  cfg = config.services.coturn;
-
   fqdn = "turn.sbruder.de";
 
   ipAddresses = [ "195.201.139.15" "2a01:4f8:1c1c:4397::" ];
-in
-{
-  services.coturn = {
-    enable = true;
 
+  cfg = {
     # config adapted from synapse’s turn howto:
     # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
     use-auth-secret = true;
     realm = fqdn;
-    # the NixOS module does not support loading the secret from a dedicated file
-    static-auth-secret = import ../secrets/turn-static-auth-secret.nix;
 
+    # not needed for VoIP
     no-tcp-relay = true;
 
+    # only tls
+    no-cli = true;
+    no-tcp = true;
+    no-udp = true;
+
+    tls-listening-port = 5349;
     cert = "/run/turnserver/fullchain.pem";
     pkey = "/run/turnserver/key.pem";
 
     min-port = 49160;
     max-port = 49200;
 
-    listening-ips = ipAddresses;
-    relay-ips = ipAddresses;
+    listening-ip = ipAddresses;
+    relay-ip = ipAddresses;
 
-    no-cli = true;
+    pidfile = "/run/turnserver/turnserver.pid";
 
-    extraConfig = ''
-      denied-peer-ip=10.0.0.0-10.255.255.255
-      denied-peer-ip=192.168.0.0-192.168.255.255
-      denied-peer-ip=172.16.0.0-172.31.255.255
+    # logging
+    no-stdout-log = true;
+    syslog = true;
 
-      user-quota=12
-      total-quota=1200
-    '';
+    denied-peer-ip = [
+      "10.0.0.0-10.255.255.255"
+      "172.16.0.0-172.31.255.255"
+      "192.168.0.0-192.168.255.255"
+    ];
+
+    user-quota = 12;
+    total-quota = 1200;
+  };
+
+  extraConfigFiles = with config.sops.secrets; [
+    turn-static-auth-secret.path
+  ];
+
+  configToText = config: lib.concatStrings
+    (lib.mapAttrsToList
+      (name: value:
+        if lib.isList value
+        then
+          lib.concatMapStrings
+            (value: "${name}=${toString value}\n")
+            value
+        else
+          (if lib.isBool value
+          then "${name}\n"
+          else "${name}=${toString value}\n"))
+      config);
+
+  configFile = pkgs.writeText "turnserver.conf" (configToText cfg);
+in
+{
+  sops.secrets.turn-static-auth-secret = {
+    owner = "turnserver";
+    sopsFile = ../secrets.yaml;
+  };
+
+  users.users.turnserver = {
+    uid = config.ids.uids.turnserver;
+  };
+  users.groups.turnserver = {
+    gid = config.ids.gids.turnserver;
+    members = [ "turnserver" ];
   };
 
   systemd.services.coturn = {
-    after = [ "acme-finished-${fqdn}.target" ];
+    after = [ "network-online.target" "acme-finished-${fqdn}.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
     serviceConfig = {
-      ExecStartPre = "!${pkgs.writeShellScript "coturn-setup-tls" ''
-        cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
-        chgrp turnserver /run/turnserver/{fullchain,key}.pem
-      ''}";
+      Type = "simple";
+      ExecStartPre = [
+        ("!" + (pkgs.writeShellScript "coturn-setup-tls" ''
+          cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
+          chgrp turnserver /run/turnserver/{fullchain,key}.pem
+        ''))
+        (pkgs.writeShellScript "coturn-setup-config" ''
+          ${pkgs.coreutils}/bin/cat ${configFile} ${lib.concatStringsSep " " extraConfigFiles} > /run/turnserver/turnserver.conf
+        '')
+      ];
+      ExecStart = "${pkgs.coturn}/bin/turnserver -c /run/turnserver/turnserver.conf";
+      Restart = "on-abort";
+      RuntimeDirectory = "turnserver";
+      RuntimeDirectoryMode = "0750";
+      User = "turnserver";
+      Group = "turnserver";
+      SupplementaryGroups = lib.singleton "keys";
     };
   };
 
   security.acme.certs."${fqdn}".postRun = ''
-    if systemctl is-active murmur; then
+    if systemctl is-active coturn; then
       systemctl --no-block restart coturn
     fi
   '';