From 9dbd7f9c8586d873ed4a7da5bb6b13491b567c3a Mon Sep 17 00:00:00 2001 From: Simon Bruder Date: Wed, 7 Apr 2021 12:23:48 +0200 Subject: [PATCH] vueko/coturn: Manage shared secret with sops This requires not using the NixOS module, since it does not support loading it from a file. --- machines/fuuko/secrets.yaml | 6 +- machines/vueko/secrets.yaml | 5 +- .../vueko/secrets/turn-static-auth-secret.nix | Bin 89 -> 0 bytes machines/vueko/services/coturn.nix | 103 ++++++++++++++---- 4 files changed, 85 insertions(+), 29 deletions(-) delete mode 100644 machines/vueko/secrets/turn-static-auth-secret.nix diff --git a/machines/fuuko/secrets.yaml b/machines/fuuko/secrets.yaml index f94fca0..6b95961 100644 --- a/machines/fuuko/secrets.yaml +++ b/machines/fuuko/secrets.yaml @@ -5,7 +5,7 @@ prometheus-htpasswd: ENC[AES256_GCM,data:eJOWrcTC3YISJJLuQV6sxzD0r8Gr8uoUt48D9sS restic-password: ENC[AES256_GCM,data:IVFXmuzzvvqDS0T3P0R5ZMIn2wdkbE1AqwDMkWqMpDdCOVMP4/HhP4jF+tEarq22,iv:Eu6Wspzm0rPl0CuSoYTTLz+MmaEtmwCD57nH2JTBuaA=,tag:tKqt5Z7nF7lLcSsDKS4E3A==,type:str] restic-s3: ENC[AES256_GCM,data:VJ/jgYnUSkbsNMb1ciLiCcRVEpuaznsSFf0QkEnPhTRHpFv4Nt0f8ARnNtG5j3iXSIT4+H2+5HWKXEsjhvL85p0XE3xe4h45xGKnvvVO2obF+b/zsMDdceFJtLbcq+APzPBjchYU,iv:W+80GhAvYD/52dNZsNYiEhiLo4dhO8oxkd+GAbk42NU=,tag:Kj9CaGo/xAmYxdoLE/Lo1Q==,type:str] synapse-registration-shared-secret: ENC[AES256_GCM,data:lNzK/7QAk4Scv+lNM8bTTKvowI139c4R4Y7Qpq60n8R61aahlxrnWc/PUEOv85Pdx+8IdBOLnV0kp7OQF6tStGBBCOkAicYmnsLoR36DmuDCvTSKVArryV7BrxL8pv0=,iv:ZT9IIF7W0NHqvnU3lPQclVS5uXXK5HIQUzXNYwYFMIo=,tag:a/sUixOlHEvn5ZOINPwQlg==,type:str] -synapse-turn-shared-secret: ENC[AES256_GCM,data:I5QbouvLvBpjroux5TTi8gIAHeyNb5KXV1g9sbTdqjD4YoMaedHSiC53h+ZMmqNCKor64e6iP58Y6SbMaTfFaEl0CyK2GqfcSBrlHxKj0GSWaopO5kLS,iv:qsfHxHykY+oZOaMGw5Tvq8a6zBUDxH3B5q8QKdT1oSk=,tag:75OOrVtztDsLYeTglKPYCQ==,type:str] +synapse-turn-shared-secret: ENC[AES256_GCM,data:sAvP4/jVma7Uq9TR4W/zEoJA17Stj75uG+G4niYaQ1tflxRhE+/HfrhMn7whnmpSgXDb/ZPtLfVaW1DCfU2jovz3Y9Ij1kveXar2aAjlPSsSVwTbFmei,iv:S7uVlE2rhK7ta2S/eX+KXBMQyc69onHYjfMNro3OCjM=,tag:rvI299PQ9TVfVzQjgfUKww==,type:str] wg-aria-private-key: ENC[AES256_GCM,data:qbxpfNRocrXDbUJ3MwR5WMXX8LB4Vnv9HMXN403ANaBbCLrRTEL9hy93roY=,iv:l2DYXGY1wN1rP2bG/s9uSwRhbvCUm2T6IJy5LKzguqk=,tag:51S+m1P1EtHk1QWEjdUCUA==,type:str] wg-home-private-key: ENC[AES256_GCM,data:6l3CgB4qCsPuyYOWuwU2vNiEeC0D1wl6yZvXGGYVsZfYvdPjRz8j5yV7ekQ=,iv:slB/qr+cxi8r7cnTuZAd8CuzWVnvp24Li6A/AnZaFzo=,tag:ynh1Z2+IELAJcgBbHwFC0A==,type:str] sops: @@ -13,8 +13,8 @@ sops: gcp_kms: [] azure_kv: [] hc_vault: [] - lastmodified: '2021-04-06T11:40:14Z' - mac: ENC[AES256_GCM,data:k9GRiDmXoKFN96NMGHt0rjAMklKIsnFUgWRP7iUQeA5j0uG4lo92KzJCMsHCIicDdF+NnNmEigeXE1eI7iet8K+rAh9x1wO8CiO/5ITsNeCzJO/PsfVxZHL1h9dqirjMkqGvKA//2nocEGv9uT/k6xezriDktBkDbLBIWg3Jfek=,iv:T5mO4IuPqO7jRRhQm2LMoW51D659SL4zVXBHbdt0Qgg=,tag:ahtBYe/18kHpGWHtqeKlAA==,type:str] + lastmodified: '2021-04-07T10:20:03Z' + mac: ENC[AES256_GCM,data:OzXpColS5Di4qRXSdkV5Ue2FqysF/GYzX9kQcEiAOZaDb9uUoKBs8EakZ4pOfcgug2/v1BIQ0aQ/Xf2uCERJzvj3rC+2Gdng0p9AC1aelEIm3vxo4hliKEG1eo5KlIrroTaQlxb1wXGKDabuy+8P57reVbLNQuM9ioQ5teuSWLk=,iv:VksbYHEVP/5zvGCgFg9e3pegDrxljkosVretlvaa6w0=,tag:mafF7XQFchHrSA2n9mE0BQ==,type:str] pgp: - created_at: '2021-04-06T11:27:21Z' enc: | diff --git a/machines/vueko/secrets.yaml b/machines/vueko/secrets.yaml index 8ddf328..cde6397 100644 --- a/machines/vueko/secrets.yaml +++ b/machines/vueko/secrets.yaml @@ -1,12 +1,13 @@ murmur-superuser: ENC[AES256_GCM,data:jTVEa1KmbGAIxxFS2/uIlDCnnJTtGmKFZQ==,iv:YJIfcXlgKEwIRzFEY94dgReNjWZqLAqL0Rb6TG4IHIE=,tag:MVzaRkb24QyyNyFCEMwmzQ==,type:str] wg-home-private-key: ENC[AES256_GCM,data:/RHNF6Zw6CTWa9ahUhGWRfkR8KIj+HdqUIojA1w6HQBFbZ/+Vo+CcYTYO5I=,iv:2sDH1P3VRjmLw6Ilkq0rw/hossHrNWP5uRvX9yr5fLE=,tag:KIT5GCfXuhg6RjA8+Nmtnw==,type:str] +turn-static-auth-secret: ENC[AES256_GCM,data:+E3Fa4X9uXg58xB7lukEdWQeW4Wj+gAKt54FSqL80+k3C/R2AGc0BC/ThP2we5lSY/kfz8W1Wk67ExEDthqlCaG84gbRRnkZ2CkFOe3QQGknHx/n,iv:MwxVxQJHiqrps0eKiXl+OxSrL1Zfo3q5zQXOeR0JofA=,tag:EUC+ZOSJMIb4QEHEFvsyZA==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] - lastmodified: '2021-04-06T11:14:32Z' - mac: ENC[AES256_GCM,data:eMx+ls4NHFqKNwW4XmrtVsizbtnASeO38cw3oPeSlvW8NbT8yUZWRxRofhzg3nD3icyGcwhImVMKHgVz5305zwvrjx0D9n+URe733WPcMmfR39G0FfXz+9kob6p5TVruKjL6qTPmyNRD+8E8CvmBmnwPwRW46F5Pvadum2SZJ3c=,iv:zVxvTUJaTx57KAglUkSNzGsxcX0csPU4qYkkLHwl7bs=,tag:a2Al47gGxFm6XubaTAdw9A==,type:str] + lastmodified: '2021-04-07T10:20:05Z' + mac: ENC[AES256_GCM,data:xfNk5YRfiQSSSxc/br7ncVSdmuDfbHandwXsLDZlIrh3QWc4DjZ1rqCRiLV8XbRntWGywRRwes6iRn2bT0MCXN+ewrcs0HOS2YjT+g8iDf2fsqZAIU34y0aXMwJTYyHyghO/naWGwb3aGAHPfuWbPg3d4xaCHwnej+nMplTkdQs=,iv:QvisjybnpHaoBdc87MPRQuu5JVPMRNV6UX19oOljv3o=,tag:E9d5/Sa5EOvqTxNYk4NxkA==,type:str] pgp: - created_at: '2021-04-06T11:13:54Z' enc: | diff --git a/machines/vueko/secrets/turn-static-auth-secret.nix b/machines/vueko/secrets/turn-static-auth-secret.nix deleted file mode 100644 index bf549254eb330e539f4b7b6d80b34b6e607a8e08..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 89 zcmV-f0H*%{M@dveQdv+`0PmXqGtkdX{mzEVb)JZCq7qr+PSjTfPUk;x;cfmrOIV!A4v diff --git a/machines/vueko/services/coturn.nix b/machines/vueko/services/coturn.nix index 33b24e3..9cd37d6 100644 --- a/machines/vueko/services/coturn.nix +++ b/machines/vueko/services/coturn.nix @@ -1,57 +1,112 @@ +# The NixOS module does not support extending the configuration with secrets. { config, lib, pkgs, ... }: let - cfg = config.services.coturn; - fqdn = "turn.sbruder.de"; ipAddresses = [ "195.201.139.15" "2a01:4f8:1c1c:4397::" ]; -in -{ - services.coturn = { - enable = true; + cfg = { # config adapted from synapse’s turn howto: # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md use-auth-secret = true; realm = fqdn; - # the NixOS module does not support loading the secret from a dedicated file - static-auth-secret = import ../secrets/turn-static-auth-secret.nix; + # not needed for VoIP no-tcp-relay = true; + # only tls + no-cli = true; + no-tcp = true; + no-udp = true; + + tls-listening-port = 5349; cert = "/run/turnserver/fullchain.pem"; pkey = "/run/turnserver/key.pem"; min-port = 49160; max-port = 49200; - listening-ips = ipAddresses; - relay-ips = ipAddresses; + listening-ip = ipAddresses; + relay-ip = ipAddresses; - no-cli = true; + pidfile = "/run/turnserver/turnserver.pid"; - extraConfig = '' - denied-peer-ip=10.0.0.0-10.255.255.255 - denied-peer-ip=192.168.0.0-192.168.255.255 - denied-peer-ip=172.16.0.0-172.31.255.255 + # logging + no-stdout-log = true; + syslog = true; - user-quota=12 - total-quota=1200 - ''; + denied-peer-ip = [ + "10.0.0.0-10.255.255.255" + "172.16.0.0-172.31.255.255" + "192.168.0.0-192.168.255.255" + ]; + + user-quota = 12; + total-quota = 1200; + }; + + extraConfigFiles = with config.sops.secrets; [ + turn-static-auth-secret.path + ]; + + configToText = config: lib.concatStrings + (lib.mapAttrsToList + (name: value: + if lib.isList value + then + lib.concatMapStrings + (value: "${name}=${toString value}\n") + value + else + (if lib.isBool value + then "${name}\n" + else "${name}=${toString value}\n")) + config); + + configFile = pkgs.writeText "turnserver.conf" (configToText cfg); +in +{ + sops.secrets.turn-static-auth-secret = { + owner = "turnserver"; + sopsFile = ../secrets.yaml; + }; + + users.users.turnserver = { + uid = config.ids.uids.turnserver; + }; + users.groups.turnserver = { + gid = config.ids.gids.turnserver; + members = [ "turnserver" ]; }; systemd.services.coturn = { - after = [ "acme-finished-${fqdn}.target" ]; + after = [ "network-online.target" "acme-finished-${fqdn}.target" ]; + wants = [ "network-online.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { - ExecStartPre = "!${pkgs.writeShellScript "coturn-setup-tls" '' - cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/ - chgrp turnserver /run/turnserver/{fullchain,key}.pem - ''}"; + Type = "simple"; + ExecStartPre = [ + ("!" + (pkgs.writeShellScript "coturn-setup-tls" '' + cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/ + chgrp turnserver /run/turnserver/{fullchain,key}.pem + '')) + (pkgs.writeShellScript "coturn-setup-config" '' + ${pkgs.coreutils}/bin/cat ${configFile} ${lib.concatStringsSep " " extraConfigFiles} > /run/turnserver/turnserver.conf + '') + ]; + ExecStart = "${pkgs.coturn}/bin/turnserver -c /run/turnserver/turnserver.conf"; + Restart = "on-abort"; + RuntimeDirectory = "turnserver"; + RuntimeDirectoryMode = "0750"; + User = "turnserver"; + Group = "turnserver"; + SupplementaryGroups = lib.singleton "keys"; }; }; security.acme.certs."${fqdn}".postRun = '' - if systemctl is-active murmur; then + if systemctl is-active coturn; then systemctl --no-block restart coturn fi '';