diff --git a/machines/vueko/configuration.nix b/machines/vueko/configuration.nix
index e9f9869..fb7724a 100644
--- a/machines/vueko/configuration.nix
+++ b/machines/vueko/configuration.nix
@@ -12,6 +12,7 @@ in
     ./hardware-configuration.nix
     ../../modules
 
+    ./services/coturn.nix
     ./services/element-web.nix
 
     "${infinisilSystem}/config/new-modules/murmur.nix"
diff --git a/machines/vueko/secrets/turn-static-auth-secret.nix b/machines/vueko/secrets/turn-static-auth-secret.nix
new file mode 100644
index 0000000..bf54925
Binary files /dev/null and b/machines/vueko/secrets/turn-static-auth-secret.nix differ
diff --git a/machines/vueko/services/coturn.nix b/machines/vueko/services/coturn.nix
new file mode 100644
index 0000000..33b24e3
--- /dev/null
+++ b/machines/vueko/services/coturn.nix
@@ -0,0 +1,73 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.coturn;
+
+  fqdn = "turn.sbruder.de";
+
+  ipAddresses = [ "195.201.139.15" "2a01:4f8:1c1c:4397::" ];
+in
+{
+  services.coturn = {
+    enable = true;
+
+    # config adapted from synapse’s turn howto:
+    # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
+    use-auth-secret = true;
+    realm = fqdn;
+    # the NixOS module does not support loading the secret from a dedicated file
+    static-auth-secret = import ../secrets/turn-static-auth-secret.nix;
+
+    no-tcp-relay = true;
+
+    cert = "/run/turnserver/fullchain.pem";
+    pkey = "/run/turnserver/key.pem";
+
+    min-port = 49160;
+    max-port = 49200;
+
+    listening-ips = ipAddresses;
+    relay-ips = ipAddresses;
+
+    no-cli = true;
+
+    extraConfig = ''
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+
+      user-quota=12
+      total-quota=1200
+    '';
+  };
+
+  systemd.services.coturn = {
+    after = [ "acme-finished-${fqdn}.target" ];
+    serviceConfig = {
+      ExecStartPre = "!${pkgs.writeShellScript "coturn-setup-tls" ''
+        cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
+        chgrp turnserver /run/turnserver/{fullchain,key}.pem
+      ''}";
+    };
+  };
+
+  security.acme.certs."${fqdn}".postRun = ''
+    if systemctl is-active murmur; then
+      systemctl --no-block restart coturn
+    fi
+  '';
+
+  services.nginx.virtualHosts."${fqdn}" = {
+    enableACME = true;
+    forceSSL = true;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ cfg.tls-listening-port ];
+    allowedUDPPorts = [ cfg.tls-listening-port ];
+
+    allowedUDPPortRanges = lib.singleton {
+      from = cfg.min-port;
+      to = cfg.min-port;
+    };
+  };
+}