DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added Coturn

Browse Source
This commit is contained in:
DerGrumpf
2026-04-14 16:58:45 +02:00
parent b049e3f5f7
commit f8eebf743f
2 changed files with 86 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
nixos/roles/matrix.nix
View File

@@ -1,14 +1,21 @@
{ pkgs, config, ... }:
let
serverIP = builtins.head (
builtins.match "([0-9.]+)/.*" config.systemd.network.networks."10-ethernet".networkConfig.Address
);
in
{ config, ... }:
{
networking.firewall.allowedTCPPorts = [
8008
8448
];
networking.firewall = {
allowedTCPPorts = [
8008
8448
3478
];
allowedUDPPorts = [
3478
];
allowedUDPPortRanges = [
{
from = 49152;
to = 65535;
}
];
};
sops.secrets = {
matrix_macaroon_secret = { };
@@ -16,37 +23,74 @@ in
owner = "matrix-synapse";
group = "matrix-synapse";
};
matrix_turn_secret = {
owner = "matrix-synapse";
group = "matrix-synapse";
};
};
services.matrix-synapse = {
enable = true;
settings = {
server_name = "cyperpunk.de";
public_baseurl = "http://matrix.cyperpunk.de";
enable_registration = false; # TODO: disable
enable_registration_without_verfication = true;
trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
listeners = [
{
port = 8008;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
services = {
matrix-synapse = {
enable = true;
settings = {
server_name = "cyperpunk.de";
public_baseurl = "https://matrix.cyperpunk.de";
enable_registration = true; # TODO: disable
enable_registration_without_verification = true;
trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
# TURN configuration
turn_uris = [
"turn:turn.cyperpunk.de?transport=udp"
"turn:turn.cyperpunk.de?transport=tcp"
];
turn_shared_secret_path = config.sops.secrets.matrix_turn_secret.path;
turn_user_lifetime = "1h";
experimental_features = {
"msc3266_enabled" = true;
};
extra_well_known_client_content = {
"io.element.call.backend" = {
url = "https://call.element.io";
};
};
listeners = [
{
port = 8008;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
};
};
coturn = {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49152;
max-port = 65535;
use-auth-secret = true;
static-auth-secret-file = config.sops.secrets.matrix_turn_secret.path;
realm = "turn.cyperpunk.de";
extraConfig = ''
no-multicast-peers
'';
};
};
}

5
secrets/secrets.yaml
View File

@@ -3,6 +3,7 @@ OPENWEATHER_API_KEY: ENC[AES256_GCM,data:bcuLz70u40nZfNgPTaeNRXdR/zjx0SQjwMbMNNF
grafana_secret_key: ENC[AES256_GCM,data:d6tu4kL7flfbdeOYk21zkSRmVe+NvVwd14jgr9Ds0adfgYetN852G25Z8/g=,iv:uWuwGBZVK1syhEfO9nLZUWwa801759tNJx+Pmnz3xeg=,tag:X6/NcdGZHAdIlOwxNPo/Ew==,type:str]
matrix_macaroon_secret: ENC[AES256_GCM,data:a9nMar+p+FXIsxxSqO/to2OJOvD1erfwLwwBeKOcWBu7xykHxqD+pCmrGhg=,iv:rp4ZDVIlZ7SN1RFHB2CfSV5ISPMl9pC4U8Jgqpz48Qs=,tag:LxmWUZE3mG4acagQmlieag==,type:str]
matrix_registration_secret: ENC[AES256_GCM,data:KhKkJZqwE8xk4/tuQ7NYTv/Ot1qCAiy8yUbDyVvRa0H5BT4amCBIdATfR4Q=,iv:HBN+GorT1VpWCVkDugk4UxYLEYKJIoDZh2d+oUDLc8g=,tag:hHus458yVnH0qaQ4u37IZg==,type:str]
matrix_turn_secret: ENC[AES256_GCM,data:HdcVJ8BjPLjjCXe8Q+lNo3R6wOiLkIaP/IABWQJKKuFmS3h+eu60naUtOPeht83Ko9dLlkgQhGJzoL8k1OyrFg==,iv:5NX6jc8Iuf9LKkqGVCNW81qPW55DN5qRiVtA+5sxgF8=,tag:jnan7xem74sC5d2aoCJ3Zw==,type:str]
vaultwarden_admin_token: ENC[AES256_GCM,data:yoBs4CaIEJXB5b3PEwTpXFgxpX39hR9A4r9yamwDV7cTSRRp3n3O2VjDKTcI5Vo6RP2QUjcqUqYf98cZ09wDMc+6+oHHJke7+O0FgRgOC0vOQFs4bfZCBJBLxogrGiwtLGkyykR6VYhrT64AN3CbrXflj82OED2Hl8WwEdruBzGIcfnh6FqQowDx6vDR/kXXJHk=,iv:PJQo5V7FaKPQ+GzZNsy3KB+xyjcDKJ1UBHErrqgn/1U=,tag:BRIDJEDOAeToqio/DHMQaA==,type:str]
flame_password: ENC[AES256_GCM,data:1rNB2CskrMV3EYII+0JfZVDvZE8=,iv:pHJtc+1YSPRYrZG97X3r0+x/cPPUlr8jO+0w2HR+VNw=,tag:qQ/1IPxweBt9iIH4Zsh7+A==,type:str]
flame_calvin_password: ENC[AES256_GCM,data:P5ppyqTjAJ1TL4hXtx5WyoS9a+g=,iv:sq98P3Oqud2FXfqsD76YS/p5NEF2xlN0MfG+ukCB9B0=,tag:AeKnu4Hg4xQ3tII0y6oNpQ==,type:str]
@@ -24,7 +25,7 @@ sops:
N3I5dzUwc3JtYzczMUhyT04vSHlZamMKT+FzYcDLmlEFYxm/XoBpJb8XaZzBH1v9
6fuez+zApathZfl14w41kAUojPWBznnxDqYtNvzVVLXwnpp3BMx+7w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-11T21:27:16Z"
mac: ENC[AES256_GCM,data:6uKae66muzkB8qPMUSkya4r4wA4oYnNttu+Md0USTHyY0VlMZefucfgpPGr79JC4l0u99kVRNyEqIY1kp/tdspeKHtGfpWmX4Djx/jMOSPWfzX99Y9ICC9KIdZgYdVJeGiwJKZUEHU0vlAopFGODQ2++sHqjrIAxO1EkGFkAgRA=,iv:Z00NF38aNk26n8+d+3b2bKFJjlN5LVWplyyE6ED9rUw=,tag:5xdT9q0dQXW/SA3CduzJug==,type:str]
lastmodified: "2026-04-14T14:21:09Z"
mac: ENC[AES256_GCM,data:+h/eJT7L80PLXN9rFf0wBz5P1rbIptv+BVj1Q0sbILRodOEfO59ztXoHmlQWeO44FdGTE3ID1/WGBDBxqBn4/QuzEWe4ToaMWlpsBCmCBlpG5zNeO7cLk7s178z6Jm+2ZIyNdoZ0x/LU2urpdUMYFQnNr5B5oZJfNxPpHwRpeew=,iv:PMiGyuVmHhKHGcxAN99GwM5OTv8FLAXPTZEjJJdg/FM=,tag:uavEchiQnwejxV2jTfZ6hw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.2