DerGrumpf/cyper-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added Coturn

Browse Source
This commit is contained in:
DerGrumpf
2026-04-14 16:58:45 +02:00
parent b049e3f5f7
commit f8eebf743f
2 changed files with 86 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

122
nixos/roles/matrix.nix
View File

@@ -1,14 +1,21 @@
{ pkgs, config, ... }:
let
serverIP = builtins.head (
builtins.match "([0-9.]+)/.*" config.systemd.network.networks."10-ethernet".networkConfig.Address
);
in
{ config, ... }:
{
networking.firewall.allowedTCPPorts = [
8008
8448
];
networking.firewall = {
allowedTCPPorts = [
8008
8448
3478
];
allowedUDPPorts = [
3478
];
allowedUDPPortRanges = [
{
from = 49152;
to = 65535;
}
];
};
sops.secrets = {
matrix_macaroon_secret = { };
@@ -16,37 +23,74 @@ in
owner = "matrix-synapse";
group = "matrix-synapse";
};
matrix_turn_secret = {
owner = "matrix-synapse";
group = "matrix-synapse";
};
};
services.matrix-synapse = {
enable = true;
settings = {
server_name = "cyperpunk.de";
public_baseurl = "http://matrix.cyperpunk.de";
enable_registration = false; # TODO: disable
enable_registration_without_verfication = true;
trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
listeners = [
{
port = 8008;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
services = {
matrix-synapse = {
enable = true;
settings = {
server_name = "cyperpunk.de";
public_baseurl = "https://matrix.cyperpunk.de";
enable_registration = true; # TODO: disable
enable_registration_without_verification = true;
trusted_key_servers = [ { server_name = "matrix.org"; } ];
suppress_key_server_warning = true;
registration_shared_secret_path = config.sops.secrets.matrix_registration_secret.path;
macaroon_secret_key = "$__file{${config.sops.secrets.matrix_macaroon_secret.path}}";
# TURN configuration
turn_uris = [
"turn:turn.cyperpunk.de?transport=udp"
"turn:turn.cyperpunk.de?transport=tcp"
];
turn_shared_secret_path = config.sops.secrets.matrix_turn_secret.path;
turn_user_lifetime = "1h";
experimental_features = {
"msc3266_enabled" = true;
};
extra_well_known_client_content = {
"io.element.call.backend" = {
url = "https://call.element.io";
};
};
listeners = [
{
port = 8008;
bind_addresses = [ "0.0.0.0" ];
type = "http";
tls = false;
x_forwarded = true;
resources = [
{
names = [
"client"
"federation"
];
compress = false;
}
];
}
];
};
};
coturn = {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49152;
max-port = 65535;
use-auth-secret = true;
static-auth-secret-file = config.sops.secrets.matrix_turn_secret.path;
realm = "turn.cyperpunk.de";
extraConfig = ''
no-multicast-peers
'';
};
};
}