diff --git a/machines/vueko/secrets.yaml b/machines/vueko/secrets.yaml index cde6397..7bdda36 100644 --- a/machines/vueko/secrets.yaml +++ b/machines/vueko/secrets.yaml @@ -1,16 +1,17 @@ murmur-superuser: ENC[AES256_GCM,data:jTVEa1KmbGAIxxFS2/uIlDCnnJTtGmKFZQ==,iv:YJIfcXlgKEwIRzFEY94dgReNjWZqLAqL0Rb6TG4IHIE=,tag:MVzaRkb24QyyNyFCEMwmzQ==,type:str] wg-home-private-key: ENC[AES256_GCM,data:/RHNF6Zw6CTWa9ahUhGWRfkR8KIj+HdqUIojA1w6HQBFbZ/+Vo+CcYTYO5I=,iv:2sDH1P3VRjmLw6Ilkq0rw/hossHrNWP5uRvX9yr5fLE=,tag:KIT5GCfXuhg6RjA8+Nmtnw==,type:str] -turn-static-auth-secret: ENC[AES256_GCM,data:+E3Fa4X9uXg58xB7lukEdWQeW4Wj+gAKt54FSqL80+k3C/R2AGc0BC/ThP2we5lSY/kfz8W1Wk67ExEDthqlCaG84gbRRnkZ2CkFOe3QQGknHx/n,iv:MwxVxQJHiqrps0eKiXl+OxSrL1Zfo3q5zQXOeR0JofA=,tag:EUC+ZOSJMIb4QEHEFvsyZA==,type:str] +turn-static-auth-secret: ENC[AES256_GCM,data:Nz94xw5sBuAgEqVpwiV44Rd3km16H46X6jVf2gzE+mbbVt2TXExv/7yegQtXI++eBo6q4wbpOfxwl0b1Pvsa/A==,iv:HSdqj43Vmq5McWAbMoxeNUa38UD75Xe4PJEwY5mKjOQ=,tag:cFpFsVwhisWt7JMMzJemCA==,type:str] sops: kms: [] gcp_kms: [] azure_kv: [] hc_vault: [] - lastmodified: '2021-04-07T10:20:05Z' - mac: ENC[AES256_GCM,data:xfNk5YRfiQSSSxc/br7ncVSdmuDfbHandwXsLDZlIrh3QWc4DjZ1rqCRiLV8XbRntWGywRRwes6iRn2bT0MCXN+ewrcs0HOS2YjT+g8iDf2fsqZAIU34y0aXMwJTYyHyghO/naWGwb3aGAHPfuWbPg3d4xaCHwnej+nMplTkdQs=,iv:QvisjybnpHaoBdc87MPRQuu5JVPMRNV6UX19oOljv3o=,tag:E9d5/Sa5EOvqTxNYk4NxkA==,type:str] + age: [] + lastmodified: "2021-12-01T16:49:21Z" + mac: ENC[AES256_GCM,data:wLy9If4/YdAVILwz1vSzCQsjG0U8Z2GvpME/+xW9pS/xmKoXTwaxP2QQpy8ReTmtikpbKS327j5pz2dSMiweqaUFSVb1nIEvUFxV4PKnxf5ubJalPZAGa82Cw0aassMKz0IAd8rDF/xK9RoB3ayRluYKAP/qnbEcFrys0BokGE0=,iv:Yw3tG1J135QImJqXEGrpSq3k8Lo++uUXfEKmCCNCpDg=,tag:FChnsJ1qIzalpVypMIilrg==,type:str] pgp: - - created_at: '2021-04-06T11:13:54Z' - enc: | + - created_at: "2021-04-06T11:13:54Z" + enc: | -----BEGIN PGP MESSAGE----- hQIMAwDgSONkM+d4ARAAxn8UVtRKn0s+wpuUBpk3cCwSSa3te4BjHshyNrI3TyZ9 @@ -28,9 +29,9 @@ sops: XDcaU74seCR/EeiuMWfEeNasu6EULEG+AKOnG9s8zoPp5730EG9v8r4q7ma89jc= =JlIF -----END PGP MESSAGE----- - fp: 47E7559E037A35652DBBF8AA8D3C82F9F309F8EC - - created_at: '2021-04-06T11:13:54Z' - enc: | + fp: 47E7559E037A35652DBBF8AA8D3C82F9F309F8EC + - created_at: "2021-04-06T11:13:54Z" + enc: | -----BEGIN PGP MESSAGE----- hQIMAzy5uO/X/tdJAQ/9Hx6h7IIjr4vwFPC3UCx07rt/lljWHwqA8d8bN3VIcVWJ @@ -48,6 +49,6 @@ sops: mSfsOU6k+KcWtXYpurZr31zUVK626Re0fsr5XbPSj+9G =Grqu -----END PGP MESSAGE----- - fp: BB046D773F54739757553A053CB9B8EFD7FED749 + fp: BB046D773F54739757553A053CB9B8EFD7FED749 unencrypted_suffix: _unencrypted - version: 3.6.0 + version: 3.7.1 diff --git a/machines/vueko/services/coturn.nix b/machines/vueko/services/coturn.nix index 720c5ee..30b7279 100644 --- a/machines/vueko/services/coturn.nix +++ b/machines/vueko/services/coturn.nix @@ -1,68 +1,10 @@ -# The NixOS module does not support extending the configuration with secrets. { config, lib, pkgs, ... }: let + cfg = config.services.coturn; + fqdn = "turn.sbruder.de"; ipAddresses = [ "195.201.139.15" "2a01:4f8:1c1c:4397::" ]; - - cfg = { - # config adapted from synapse’s turn howto: - # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md - use-auth-secret = true; - realm = fqdn; - - # not needed for VoIP - no-tcp-relay = true; - - no-cli = true; - - listening-port = 3478; - - tls-listening-port = 5349; - cert = "/run/turnserver/fullchain.pem"; - pkey = "/run/turnserver/key.pem"; - - min-port = 49160; - max-port = 49200; - - listening-ip = ipAddresses; - relay-ip = ipAddresses; - - pidfile = "/run/turnserver/turnserver.pid"; - - # logging - no-stdout-log = true; - syslog = true; - - denied-peer-ip = [ - "10.0.0.0-10.255.255.255" - "172.16.0.0-172.31.255.255" - "192.168.0.0-192.168.255.255" - ]; - - user-quota = 12; - total-quota = 1200; - }; - - extraConfigFiles = with config.sops.secrets; [ - turn-static-auth-secret.path - ]; - - configToText = config: lib.concatStrings - (lib.mapAttrsToList - (name: value: - if lib.isList value - then - lib.concatMapStrings - (value: "${name}=${toString value}\n") - value - else - (if lib.isBool value - then "${name}\n" - else "${name}=${toString value}\n")) - config); - - configFile = pkgs.writeText "turnserver.conf" (configToText cfg); in { sops.secrets.turn-static-auth-secret = { @@ -70,37 +12,46 @@ in sopsFile = ../secrets.yaml; }; - users.users.turnserver = { - uid = config.ids.uids.turnserver; - }; - users.groups.turnserver = { - gid = config.ids.gids.turnserver; - members = [ "turnserver" ]; + services.coturn = { + enable = true; + + # config adapted from synapse’s turn howto: + # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md + use-auth-secret = true; + realm = fqdn; + # the NixOS module does not support loading the secret from a dedicated file + static-auth-secret-file = config.sops.secrets.turn-static-auth-secret.path; + + no-tcp-relay = true; + + cert = "/run/turnserver/fullchain.pem"; + pkey = "/run/turnserver/key.pem"; + + min-port = 49160; + max-port = 49200; + + listening-ips = ipAddresses; + relay-ips = ipAddresses; + + no-cli = true; + + extraConfig = '' + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + + user-quota=12 + total-quota=1200 + ''; }; systemd.services.coturn = { - after = [ "network-online.target" "acme-finished-${fqdn}.target" ]; - wants = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - + after = [ "acme-finished-${fqdn}.target" ]; serviceConfig = { - Type = "simple"; - ExecStartPre = [ - ("!" + (pkgs.writeShellScript "coturn-setup-tls" '' - cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/ - chgrp turnserver /run/turnserver/{fullchain,key}.pem - '')) - (pkgs.writeShellScript "coturn-setup-config" '' - ${pkgs.coreutils}/bin/cat ${configFile} ${lib.concatStringsSep " " extraConfigFiles} > /run/turnserver/turnserver.conf - '') - ]; - ExecStart = "${pkgs.coturn}/bin/turnserver -c /run/turnserver/turnserver.conf"; - Restart = "on-abort"; - RuntimeDirectory = "turnserver"; - RuntimeDirectoryMode = "0750"; - User = "turnserver"; - Group = "turnserver"; - SupplementaryGroups = lib.singleton "keys"; + ExecStartPre = lib.singleton "!${pkgs.writeShellScript "coturn-setup-tls" '' + cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/ + chgrp turnserver /run/turnserver/{fullchain,key}.pem + ''}"; }; }; @@ -116,8 +67,8 @@ in }; networking.firewall = { - allowedTCPPorts = [ cfg.listening-port cfg.tls-listening-port ]; - allowedUDPPorts = [ cfg.listening-port cfg.tls-listening-port ]; + allowedTCPPorts = with cfg; [ listening-port alt-listening-port tls-listening-port ]; + allowedUDPPorts = with cfg; [ listening-port alt-listening-port tls-listening-port ]; allowedUDPPortRanges = lib.singleton { from = cfg.min-port;