Matrix migration + coturn test

systems/x86_64-linux/stargate/services/coturn.nix

@@ -0,0 +1,67 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  users.groups.turn-secret.members = ["turnserver" "conduwuit"];
+
+  sops.secrets."services/turn" = {
+    mode = "640";
+    owner = "turnserver";
+    group = "turn-secret";
+  };
+  services.coturn = {
+    enable = true;
+    realm = "turn.kylekrein.com";
+    no-tcp-relay = true;
+
+    listening-ips = ["0.0.0.0"];
+    listening-port = 3478;
+    tls-listening-port = 3480;
+
+    #relay-ips = [ "kylekrein.duckdns.org" ];
+    min-port = 60000;
+    max-port = 65535;
+
+    cert = "${config.security.acme.certs."turn.kylekrein.com".directory}/fullchain.pem";
+    pkey = "${config.security.acme.certs."turn.kylekrein.com".directory}/key.pem";
+
+    #no-auth = true;
+    #no-tcp = true;
+    secure-stun = true;
+    # lt-cred-mech = true;
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets."services/turn".path;
+
+    extraConfig = ''
+      no-multicast-peers
+    '';
+  };
+
+  security.acme.certs.${config.services.coturn.realm} = {
+    /*
+    insert here the right configuration to obtain a certificate
+    */
+    postRun = "systemctl restart coturn.service";
+    group = "nginx";
+  };
+
+  # allow coturn to read certificate files
+  users.users.turnserver.extraGroups = ["nginx"];
+  networking.firewall.allowedTCPPorts = [
+    config.services.coturn.listening-port
+    config.services.coturn.tls-listening-port
+  ];
+  networking.firewall.allowedUDPPorts = [
+    config.services.coturn.listening-port
+    config.services.coturn.tls-listening-port
+  ];
+
+  networking.firewall.allowedUDPPortRanges = [
+    {
+      from = config.services.coturn.min-port;
+      to = config.services.coturn.max-port;
+    }
+  ];
+}