From deba8c91eb4892c31864c7d03506eb70cae1baff Mon Sep 17 00:00:00 2001
From: stuebinm
Date: Fri, 19 Mar 2021 22:53:25 +0100
Subject: migrating chaski config

---
 hosts/chaski/services/coturn.nix | 57 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 hosts/chaski/services/coturn.nix

(limited to 'hosts/chaski/services/coturn.nix')

diff --git a/hosts/chaski/services/coturn.nix b/hosts/chaski/services/coturn.nix
new file mode 100644
index 0000000..9a2211f
--- /dev/null
+++ b/hosts/chaski/services/coturn.nix
@@ -0,0 +1,57 @@
+{pkgs, config, ...}:
+
+{
+  services.coturn = {
+    enable = true;
+    realm = "chaski.stuebinm.eu";
+#    static-auth-secret = "chaski";
+#    use-auth-secret = true;
+    no-cli = true;
+#    no-tcp-relay = true;
+    lt-cred-mech = true;
+    extraConfig = ''
+      verbose
+      fingerprint
+      external-ip=95.217.159.23
+      user=chaski:chaski
+      server-name=chaski.stuebinm.eu
+      #mobility
+      #listening-ip=95.217.159.23
+      prometheus
+    '';
+
+    cert = config.security.acme.certs."chaski.stuebinm.eu".directory + "full.pem";
+    pkey = config.security.acme.certs."chaski.stuebinm.eu".directory + "key.pem";
+  };
+
+  security.acme = {
+    email = "stuebinm@disroot.org";
+    acceptTerms = true;
+  };
+
+  # just here to serve acme challanges
+  services.nginx = {
+    enable = true;
+    user = "turnserver";
+    virtualHosts."chaski.stuebinm.eu" = {
+      root = "/var/www";
+      enableACME = true;
+    };
+  };
+
+  networking.firewall = with config.services.coturn; {
+    allowedTCPPorts = [
+        80 # for acme challanges
+        listening-port tls-listening-port
+        (listening-port +1) (tls-listening-port +1)
+    ];
+    allowedUDPPorts = [
+      listening-port
+      tls-listening-port
+      (listening-port +1) (tls-listening-port +1)
+    ];
+    allowedUDPPortRanges = [
+      { from = min-port; to = max-port; }
+    ];
+  };
+}
-- 
cgit v1.2.3