NixOS-Config/system/services/social/matrix/synapse/coturn/default.nix

{ outputs, config, ... }: {
  services = {
    coturn = {
      enable = true;
      no-cli = true;
      no-tcp-relay = true;
      min-port = 49000;
      max-port = 50000;
      use-auth-secret = true;
      static-auth-secret = "will be world readable for local users :(";
      realm = "turn.${outputs.secrets.jimDomain}";
      cert = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/fullchain.pem";
      pkey = "/var/lib/acme/turn.${outputs.secrets.jimDomain}.com/key.pem";
    };

    # Enable coturn on Synapse
    matrix-synapse.settings = {
      turn_uris = [
        "turn:turn.${outputs.secrets.jimDomain}:3478?transport=udp"
        "turn:turn.${outputs.secrets.jimDomain}:3478?transport=tcp"
      ];
      turn_shared_secret = config.services.coturn.static-auth-secret;
      turn_user_lifetime = "1h";
    };
  };

  # Open coturn ports
  networking.firewall = {
    allowedUDPPorts = [
      3478 5349
    ];
    allowedUDPPortRanges = [
      { from = 49000; to = 50000; }
    ];
  };
}