39 lines
953 B
Nix
39 lines
953 B
Nix
|
{outputs, ...}: {
|
||
|
|
services = {
|
||
|
|
coturn = rec {
|
||
|
|
enable = true;
|
||
|
|
no-cli = true;
|
||
|
|
no-tcp-relay = true;
|
||
|
|
min-port = 49000;
|
||
|
|
max-port = 50000;
|
||
|
|
use-auth-secret = true;
|
||
|
|
static-auth-secret = "will be world readable for local users :(";
|
||
|
|
realm = "turn.${outputs.secrets.jimDomain}";
|
||
|
|
cert = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/fullchain.pem";
|
||
|
|
pkey = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/key.pem";
|
||
|
|
};
|
||
|
|
|
||
|
|
# Proxy main coturn port
|
||
|
|
nginx.virtualHosts."turn.${outputs.secrets.jimDomain}" = {
|
||
|
|
enableACME = true;
|
||
|
|
forceSSL = true;
|
||
|
|
listen = [{
|
||
|
|
addr = "0.0.0.0";
|
||
|
|
port = 80;
|
||
|
|
ssl = false;
|
||
|
|
}];
|
||
|
|
locations."/".proxyPass = "http://127.0.0.1:1380";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
# Open coturn ports
|
||
|
|
networking.firewall = {
|
||
|
|
allowedUDPPorts = [
|
||
|
|
3478 5349
|
||
|
|
];
|
||
|
|
allowedUDPPortRanges = [
|
||
|
|
{ from = 49000; to = 50000; }
|
||
|
|
];
|
||
|
|
};
|
||
|
|
}
|