simon/nixos-config
simon/nixos-config
1
1
Fork 0
Code Issues 8 Pull requests Actions Projects Activity

vueko/coturn: Manage shared secret with sops

Browse source 
This requires not using the NixOS module, since it does not support
loading it from a file.
This commit is contained in:
Simon Bruder 2021-04-07 12:23:48 +02:00
parent 4a8a7e0a4f
commit 9dbd7f9c85
Signed by: simon
GPG key ID: 8D3C82F9F309F8EC
4 changed files with 85 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
machines/fuuko/secrets.yaml
View file

@ -5,7 +5,7 @@ prometheus-htpasswd: ENC[AES256_GCM,data:eJOWrcTC3YISJJLuQV6sxzD0r8Gr8uoUt48D9sS
restic-password: ENC[AES256_GCM,data:IVFXmuzzvvqDS0T3P0R5ZMIn2wdkbE1AqwDMkWqMpDdCOVMP4/HhP4jF+tEarq22,iv:Eu6Wspzm0rPl0CuSoYTTLz+MmaEtmwCD57nH2JTBuaA=,tag:tKqt5Z7nF7lLcSsDKS4E3A==,type:str]
restic-s3: ENC[AES256_GCM,data:VJ/jgYnUSkbsNMb1ciLiCcRVEpuaznsSFf0QkEnPhTRHpFv4Nt0f8ARnNtG5j3iXSIT4+H2+5HWKXEsjhvL85p0XE3xe4h45xGKnvvVO2obF+b/zsMDdceFJtLbcq+APzPBjchYU,iv:W+80GhAvYD/52dNZsNYiEhiLo4dhO8oxkd+GAbk42NU=,tag:Kj9CaGo/xAmYxdoLE/Lo1Q==,type:str]
synapse-registration-shared-secret: ENC[AES256_GCM,data:lNzK/7QAk4Scv+lNM8bTTKvowI139c4R4Y7Qpq60n8R61aahlxrnWc/PUEOv85Pdx+8IdBOLnV0kp7OQF6tStGBBCOkAicYmnsLoR36DmuDCvTSKVArryV7BrxL8pv0=,iv:ZT9IIF7W0NHqvnU3lPQclVS5uXXK5HIQUzXNYwYFMIo=,tag:a/sUixOlHEvn5ZOINPwQlg==,type:str]
synapse-turn-shared-secret: ENC[AES256_GCM,data:I5QbouvLvBpjroux5TTi8gIAHeyNb5KXV1g9sbTdqjD4YoMaedHSiC53h+ZMmqNCKor64e6iP58Y6SbMaTfFaEl0CyK2GqfcSBrlHxKj0GSWaopO5kLS,iv:qsfHxHykY+oZOaMGw5Tvq8a6zBUDxH3B5q8QKdT1oSk=,tag:75OOrVtztDsLYeTglKPYCQ==,type:str]
synapse-turn-shared-secret: ENC[AES256_GCM,data:sAvP4/jVma7Uq9TR4W/zEoJA17Stj75uG+G4niYaQ1tflxRhE+/HfrhMn7whnmpSgXDb/ZPtLfVaW1DCfU2jovz3Y9Ij1kveXar2aAjlPSsSVwTbFmei,iv:S7uVlE2rhK7ta2S/eX+KXBMQyc69onHYjfMNro3OCjM=,tag:rvI299PQ9TVfVzQjgfUKww==,type:str]
wg-aria-private-key: ENC[AES256_GCM,data:qbxpfNRocrXDbUJ3MwR5WMXX8LB4Vnv9HMXN403ANaBbCLrRTEL9hy93roY=,iv:l2DYXGY1wN1rP2bG/s9uSwRhbvCUm2T6IJy5LKzguqk=,tag:51S+m1P1EtHk1QWEjdUCUA==,type:str]
wg-home-private-key: ENC[AES256_GCM,data:6l3CgB4qCsPuyYOWuwU2vNiEeC0D1wl6yZvXGGYVsZfYvdPjRz8j5yV7ekQ=,iv:slB/qr+cxi8r7cnTuZAd8CuzWVnvp24Li6A/AnZaFzo=,tag:ynh1Z2+IELAJcgBbHwFC0A==,type:str]
sops:
@ -13,8 +13,8 @@ sops:
gcp_kms: []
azure_kv: []
hc_vault: []
lastmodified: '2021-04-06T11:40:14Z'
mac: ENC[AES256_GCM,data:k9GRiDmXoKFN96NMGHt0rjAMklKIsnFUgWRP7iUQeA5j0uG4lo92KzJCMsHCIicDdF+NnNmEigeXE1eI7iet8K+rAh9x1wO8CiO/5ITsNeCzJO/PsfVxZHL1h9dqirjMkqGvKA//2nocEGv9uT/k6xezriDktBkDbLBIWg3Jfek=,iv:T5mO4IuPqO7jRRhQm2LMoW51D659SL4zVXBHbdt0Qgg=,tag:ahtBYe/18kHpGWHtqeKlAA==,type:str]
lastmodified: '2021-04-07T10:20:03Z'
mac: ENC[AES256_GCM,data:OzXpColS5Di4qRXSdkV5Ue2FqysF/GYzX9kQcEiAOZaDb9uUoKBs8EakZ4pOfcgug2/v1BIQ0aQ/Xf2uCERJzvj3rC+2Gdng0p9AC1aelEIm3vxo4hliKEG1eo5KlIrroTaQlxb1wXGKDabuy+8P57reVbLNQuM9ioQ5teuSWLk=,iv:VksbYHEVP/5zvGCgFg9e3pegDrxljkosVretlvaa6w0=,tag:mafF7XQFchHrSA2n9mE0BQ==,type:str]
pgp:
- created_at: '2021-04-06T11:27:21Z'
enc: |

5
machines/vueko/secrets.yaml
View file

@ -1,12 +1,13 @@
murmur-superuser: ENC[AES256_GCM,data:jTVEa1KmbGAIxxFS2/uIlDCnnJTtGmKFZQ==,iv:YJIfcXlgKEwIRzFEY94dgReNjWZqLAqL0Rb6TG4IHIE=,tag:MVzaRkb24QyyNyFCEMwmzQ==,type:str]
wg-home-private-key: ENC[AES256_GCM,data:/RHNF6Zw6CTWa9ahUhGWRfkR8KIj+HdqUIojA1w6HQBFbZ/+Vo+CcYTYO5I=,iv:2sDH1P3VRjmLw6Ilkq0rw/hossHrNWP5uRvX9yr5fLE=,tag:KIT5GCfXuhg6RjA8+Nmtnw==,type:str]
turn-static-auth-secret: ENC[AES256_GCM,data:+E3Fa4X9uXg58xB7lukEdWQeW4Wj+gAKt54FSqL80+k3C/R2AGc0BC/ThP2we5lSY/kfz8W1Wk67ExEDthqlCaG84gbRRnkZ2CkFOe3QQGknHx/n,iv:MwxVxQJHiqrps0eKiXl+OxSrL1Zfo3q5zQXOeR0JofA=,tag:EUC+ZOSJMIb4QEHEFvsyZA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
lastmodified: '2021-04-06T11:14:32Z'
mac: ENC[AES256_GCM,data:eMx+ls4NHFqKNwW4XmrtVsizbtnASeO38cw3oPeSlvW8NbT8yUZWRxRofhzg3nD3icyGcwhImVMKHgVz5305zwvrjx0D9n+URe733WPcMmfR39G0FfXz+9kob6p5TVruKjL6qTPmyNRD+8E8CvmBmnwPwRW46F5Pvadum2SZJ3c=,iv:zVxvTUJaTx57KAglUkSNzGsxcX0csPU4qYkkLHwl7bs=,tag:a2Al47gGxFm6XubaTAdw9A==,type:str]
lastmodified: '2021-04-07T10:20:05Z'
mac: ENC[AES256_GCM,data:xfNk5YRfiQSSSxc/br7ncVSdmuDfbHandwXsLDZlIrh3QWc4DjZ1rqCRiLV8XbRntWGywRRwes6iRn2bT0MCXN+ewrcs0HOS2YjT+g8iDf2fsqZAIU34y0aXMwJTYyHyghO/naWGwb3aGAHPfuWbPg3d4xaCHwnej+nMplTkdQs=,iv:QvisjybnpHaoBdc87MPRQuu5JVPMRNV6UX19oOljv3o=,tag:E9d5/Sa5EOvqTxNYk4NxkA==,type:str]
pgp:
- created_at: '2021-04-06T11:13:54Z'
enc: |

BIN
machines/vueko/secrets/turn-static-auth-secret.nix
View file

Binary file not shown.

103
machines/vueko/services/coturn.nix
View file

@ -1,57 +1,112 @@
# The NixOS module does not support extending the configuration with secrets.
{ config, lib, pkgs, ... }:
let
cfg = config.services.coturn;
fqdn = "turn.sbruder.de";
ipAddresses = [ "195.201.139.15" "2a01:4f8:1c1c:4397::" ];
in
{
services.coturn = {
enable = true;
cfg = {
# config adapted from synapse’s turn howto:
# https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
use-auth-secret = true;
realm = fqdn;
# the NixOS module does not support loading the secret from a dedicated file
static-auth-secret = import ../secrets/turn-static-auth-secret.nix;
# not needed for VoIP
no-tcp-relay = true;
# only tls
no-cli = true;
no-tcp = true;
no-udp = true;
tls-listening-port = 5349;
cert = "/run/turnserver/fullchain.pem";
pkey = "/run/turnserver/key.pem";
min-port = 49160;
max-port = 49200;
listening-ips = ipAddresses;
relay-ips = ipAddresses;
listening-ip = ipAddresses;
relay-ip = ipAddresses;
no-cli = true;
pidfile = "/run/turnserver/turnserver.pid";
extraConfig = ''
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
# logging
no-stdout-log = true;
syslog = true;
user-quota=12
total-quota=1200
'';
denied-peer-ip = [
"10.0.0.0-10.255.255.255"
"172.16.0.0-172.31.255.255"
"192.168.0.0-192.168.255.255"
];
user-quota = 12;
total-quota = 1200;
};
extraConfigFiles = with config.sops.secrets; [
turn-static-auth-secret.path
];
configToText = config: lib.concatStrings
(lib.mapAttrsToList
(name: value:
if lib.isList value
then
lib.concatMapStrings
(value: "${name}=${toString value}\n")
value
else
(if lib.isBool value
then "${name}\n"
else "${name}=${toString value}\n"))
config);
configFile = pkgs.writeText "turnserver.conf" (configToText cfg);
in
{
sops.secrets.turn-static-auth-secret = {
owner = "turnserver";
sopsFile = ../secrets.yaml;
};
users.users.turnserver = {
uid = config.ids.uids.turnserver;
};
users.groups.turnserver = {
gid = config.ids.gids.turnserver;
members = [ "turnserver" ];
};
systemd.services.coturn = {
after = [ "acme-finished-${fqdn}.target" ];
after = [ "network-online.target" "acme-finished-${fqdn}.target" ];
wants = [ "network-online.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
ExecStartPre = "!${pkgs.writeShellScript "coturn-setup-tls" ''
cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
chgrp turnserver /run/turnserver/{fullchain,key}.pem
''}";
Type = "simple";
ExecStartPre = [
("!" + (pkgs.writeShellScript "coturn-setup-tls" ''
cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
chgrp turnserver /run/turnserver/{fullchain,key}.pem
''))
(pkgs.writeShellScript "coturn-setup-config" ''
${pkgs.coreutils}/bin/cat ${configFile} ${lib.concatStringsSep " " extraConfigFiles} > /run/turnserver/turnserver.conf
'')
];
ExecStart = "${pkgs.coturn}/bin/turnserver -c /run/turnserver/turnserver.conf";
Restart = "on-abort";
RuntimeDirectory = "turnserver";
RuntimeDirectoryMode = "0750";
User = "turnserver";
Group = "turnserver";
SupplementaryGroups = lib.singleton "keys";
};
};
security.acme.certs."${fqdn}".postRun = ''
if systemctl is-active murmur; then
if systemctl is-active coturn; then
systemctl --no-block restart coturn
fi
'';