diff options
author | sefidel <contact@sefidel.net> | 2024-01-24 19:18:11 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2024-01-24 19:18:11 +0900 |
commit | 497c3cd7864fdbcc546408d6d86ebfad37aa9b78 (patch) | |
tree | 6cd5bf30b9953156d71192fa96e34a863dda5926 /modules/services/coturn.nix | |
parent | a1dc1ff8c07155f697a30145168820612b28b6cd (diff) | |
download | infra-modules.tar.gz infra-modules.zip |
wip: try to use infra-modules infra-modules
Diffstat (limited to 'modules/services/coturn.nix')
-rw-r--r-- | modules/services/coturn.nix | 64 |
1 files changed, 0 insertions, 64 deletions
diff --git a/modules/services/coturn.nix b/modules/services/coturn.nix deleted file mode 100644 index 967ba60..0000000 --- a/modules/services/coturn.nix +++ /dev/null @@ -1,64 +0,0 @@ -{ config, lib, ... }: - -with lib; -let - turnRange = with config.services.coturn; [{ - from = min-port; - to = max-port; - }]; - - cfg = config.modules.services.coturn; -in -{ - options.modules.services.coturn = { - enable = mkEnableOption "coturn"; - domain = mkOption { type = types.str; default = config.networking.hostName; }; - shared_secret = mkOption { type = types.str; }; - tls.acmeHost = mkOption { type = types.str; default = cfg.domain; }; - }; - - config = mkIf cfg.enable { - services.coturn = { - enable = true; - use-auth-secret = true; - static-auth-secret = cfg.shared_secret; - realm = cfg.domain; - cert = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/fullchain.pem"; - pkey = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/key.pem"; - - no-tcp-relay = true; - no-cli = true; - - extraConfig = '' - user-quota=12 - total-quota=1200 - - no-loopback-peers - no-multicast-peers - denied-peer-ip=0.0.0.0-0.255.255.255 - denied-peer-ip=10.0.0.0-10.255.255.255 - denied-peer-ip=100.64.0.0-100.127.255.255 - denied-peer-ip=127.0.0.0-127.255.255.255 - denied-peer-ip=169.254.0.0-169.254.255.255 - denied-peer-ip=172.16.0.0-172.31.255.255 - denied-peer-ip=192.0.0.0-192.0.0.255 - denied-peer-ip=192.0.2.0-192.0.2.255 - denied-peer-ip=192.88.99.0-192.88.99.255 - denied-peer-ip=192.168.0.0-192.168.255.255 - denied-peer-ip=198.18.0.0-198.19.255.255 - denied-peer-ip=198.51.100.0-198.51.100.255 - denied-peer-ip=203.0.113.0-203.0.113.255 - denied-peer-ip=240.0.0.0-255.255.255.255 - ''; - }; - - systemd.services.coturn = { - serviceConfig.SupplementaryGroups = [ "acme" ]; - }; - - networking.firewall.allowedUDPPortRanges = turnRange; - networking.firewall.allowedTCPPortRanges = turnRange; - networking.firewall.allowedTCPPorts = [ 3478 3479 5349 5350 ]; - networking.firewall.allowedUDPPorts = [ 3478 3479 5349 5350 ]; - }; -} |