Matrix migration + coturn test

modules/nixos/programs/sops/secrets/secrets.yaml

@@ -4,6 +4,7 @@ users:
     andrej: ENC[AES256_GCM,data:x/cWcswSDMFxXSLXe1JWGnQAuPYWM5AU4X3WxVAqUIifcYWxxynMfL9LXEgo3sP1IvRyp4FW+voWQrJM/KGdbYkkrAJNhbD7/Q==,iv:C51H9Zz4nxB+K1cohRq+1oPQ/ckDgVCMW4vB4+3wEt8=,tag:8ENLfMIoHbJGxceCKZulxg==,type:str]
 duckdns: ENC[AES256_GCM,data:QslHkm7T0PIx3WbYDi1wILL1ap1R/vRdjTu448DxQxdHdxOX,iv:eB0PspBBReCjuC17mAwSMJoSZ4G3lErTml0ifp3vCGw=,tag:4vaCLCc+V6ePenvTo7VsGA==,type:str]
 services:
+    turn: ENC[AES256_GCM,data:uk3Skyorpy4ECvufTtcjQUXqVEhC5ngSZhogqkm7j/boGZ+6AiHJG/nggNXMIA1691TyFZwtSDLOhfS37RfI+w==,iv:cDePrmHp0RDIOcJlCbow53003/Gq1OnC6wnfGnLjpDA=,tag:mY9U9MFu9+gA/c4cg5pP0A==,type:str]
     conduwuit: ENC[AES256_GCM,data:1shEq67QJTkeqrfYSr/eYG7gYWH//5ey6XQ=,iv:hy5wQmue8qU4ALfn9BrNQLnsTk8BsVVXY/8bDj18mXk=,tag:h6+hL0HjgSzd15Kc7Zg4ng==,type:str]
     nextcloud: ENC[AES256_GCM,data:YLRMhChTu/UQI+HIcUjNFFK+CfSCl2+0kfSkSfauAftRO2A1VHhyCjP5,iv:DLfhSvNRWXVU5XE3SwV4vZmAQI2ZVa+ak/g5Nu+Fgcg=,tag:K3nWfJRNxodeMkxGG3ljmg==,type:str]
     paperless: ENC[AES256_GCM,data:VjbEtwfY4T0Bpb+iutN7kDMqgcRy4ThQJiVyCHHT,iv:rlWB0ZfFYuKkpAfIzxryySH+Zl8hLf6c9UTjv1hVDVI=,tag:gHFoJZoKFOVupmE2VSJOoA==,type:str]
@@ -59,7 +60,7 @@ sops:
             MU43ZWEwMXEwdGx5d0hUNlhiaGdjWU0K9UoNQOnMxTy0KdfiYOgm0TxH5qFUV3gi
             f7z2RzR44ndf0nHwIzr8e1bmF9q5mc685Wq9qyM7aLCE+yUU/vUO7Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-06T23:08:49Z"
+    lastmodified: "2025-10-12T12:34:53Z"
-    mac: ENC[AES256_GCM,data:+BnoQNO6WLFKxPQmKR2XVAgwH4UY+VYtnvmE5Qz5OOk6IfQQnEea3IIHrcKojA2JwIS5BpdvnOtALar3dFl99UxP6Ff7OxR5fUv/QOxoCXSdNC0L61F3GY60qRwPwyj5Fq052ZjvL5gQ0dZVblLtZksNvDZXQ9gF1CKef689l1s=,iv:poB1TfxYWIfRvdDdi8pp30vwRjf3MR55uHYWPk2JPi4=,tag:Kse/zReeQWaOwT744A3TCQ==,type:str]
+    mac: ENC[AES256_GCM,data:9M9Wu84bcwEn4QpnUwPfj3O36+ck6KeDqfoy58RSMi7iZNBc8QmMqQ0f/KsQ1+pLkwW0Mr/JM9ORv8LjedHPPUGVS6m4s1x720B5UZVpDYsjNmT4dH6wXbeUWAuHGQeRQb8EGhoCuo8ZxkeFF+xAoW34u/utImfEyoru62MhQpI=,iv:9oPzYdhnw7o4Pq+IpkWzAcoFhpKeJYG2kF8keAbiG7M=,tag:iwx/qNUUV4HBmWGodyCfRA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

systems/x86_64-linux/stargate/services/coturn.nix

@@ -0,0 +1,67 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: {
+  users.groups.turn-secret.members = ["turnserver" "conduwuit"];
+
+  sops.secrets."services/turn" = {
+    mode = "640";
+    owner = "turnserver";
+    group = "turn-secret";
+  };
+  services.coturn = {
+    enable = true;
+    realm = "turn.kylekrein.com";
+    no-tcp-relay = true;
+
+    listening-ips = ["0.0.0.0"];
+    listening-port = 3478;
+    tls-listening-port = 3480;
+
+    #relay-ips = [ "kylekrein.duckdns.org" ];
+    min-port = 60000;
+    max-port = 65535;
+
+    cert = "${config.security.acme.certs."turn.kylekrein.com".directory}/fullchain.pem";
+    pkey = "${config.security.acme.certs."turn.kylekrein.com".directory}/key.pem";
+
+    #no-auth = true;
+    #no-tcp = true;
+    secure-stun = true;
+    # lt-cred-mech = true;
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets."services/turn".path;
+
+    extraConfig = ''
+      no-multicast-peers
+    '';
+  };
+
+  security.acme.certs.${config.services.coturn.realm} = {
+    /*
+    insert here the right configuration to obtain a certificate
+    */
+    postRun = "systemctl restart coturn.service";
+    group = "nginx";
+  };
+
+  # allow coturn to read certificate files
+  users.users.turnserver.extraGroups = ["nginx"];
+  networking.firewall.allowedTCPPorts = [
+    config.services.coturn.listening-port
+    config.services.coturn.tls-listening-port
+  ];
+  networking.firewall.allowedUDPPorts = [
+    config.services.coturn.listening-port
+    config.services.coturn.tls-listening-port
+  ];
+
+  networking.firewall.allowedUDPPortRanges = [
+    {
+      from = config.services.coturn.min-port;
+      to = config.services.coturn.max-port;
+    }
+  ];
+}

systems/x86_64-linux/stargate/services/matrix.nix

@@ -0,0 +1,47 @@
+{
+  pkgs,
+  lib,
+  config,
+  namespace,
+  ...
+}: {
+  ${namespace}.services.conduwuit = {
+    enable = true;
+    #user = "turnserver";
+    settings = {
+      global = {
+        server_name = "kylekrein.com";
+        well_known = {
+          server = "matrix.kylekrein.com:443";
+          client = "https://matrix.kylekrein.com";
+        };
+        port = [6167];
+        trusted_servers = ["matrix.org"];
+        allow_registration = false;
+        registration_token = null; #nix shell nixpkgs#openssl -c openssl rand -base64 48 | tr -d '/+' | cut -c1-64
+        allow_federation = true;
+        allow_encryption = true;
+
+        allow_local_presence = true;
+        require_auth_for_profile_requests = true;
+
+        rocksdb_optimize_for_spinning_disks = true;
+
+        turn_uris = let
+          coturn = config.services.coturn;
+        in [
+          "turns:turn.kylekrein.com:${builtins.toString coturn.tls-listening-port}?transport=udp"
+          "turns:turn.kylekrein.com:${builtins.toString coturn.tls-listening-port}?transport=tcp"
+          "turn:turn.kylekrein.com:${builtins.toString coturn.listening-port}?transport=udp"
+          "turn:turn.kylekrein.com:${builtins.toString coturn.listening-port}?transport=tcp"
+        ];
+        turn_secret_file = config.sops.secrets."services/turn".path;
+        turn_user_lifetime = "1h";
+        turn_allow_guests = false;
+      };
+    };
+    extraEnvironment = {
+    };
+  };
+  networking.firewall.allowedTCPPorts = [8448];
+}

systems/x86_64-linux/stargate/services/nextcloud.nix

@@ -16,6 +16,7 @@ with lib.custom; {
   sops.secrets."services/nextcloud" = {owner = "nextcloud";};
   services.nextcloud = {
     enable = true;
+    package = pkgs.nextcloud32;
     database.createLocally = true;
     config = {
       dbtype = "pgsql";
@@ -23,5 +24,12 @@ with lib.custom; {
     };
     hostName = "nextcloud.kylekrein.com";
     https = true;
+    extraApps = {
+      inherit (config.services.nextcloud.package.packages.apps) contacts calendar tasks whiteboard;
+    };
+    autoUpdateApps.enable = true;
+    extraAppsEnable = true;
+
+    configureRedis = false;
   };
 }

systems/x86_64-linux/stargate/services/nginx.nix

@@ -9,7 +9,7 @@
       extraConfig = ''
         add_header Access-Control-Allow-Origin *;
         add_header Content-Type application/json;
-        return 200 '{"m.homeserver": { "base_url": "https://matrix.kylekrein.com/" }, "org.matrix.msc3575.proxy": { "url": "https://matrix.kylekrein.com/"}, "org.matrix.msc4143.rtc_foci": [ { "type": "livekit", "livekit_service_url": "https://livekit-jwt.call.matrix.org" } ] }';
+        return 200 '{"m.homeserver": { "base_url": "https://matrix.kylekrein.com" }, "org.matrix.msc3575.proxy": { "url": "https://matrix.kylekrein.com"}}';
       '';
     };
     "~ ^/\\.well-known/matrix/server$" = {
@@ -18,12 +18,6 @@
         return 200 '{"m.server": "matrix.kylekrein.com:443"}';
       '';
     };
-    "~ ^/\\.well-known/element/element.json$" = {
-      extraConfig = ''
-        add_header Content-Type application/json;
-        return 200 '{"call":{"widget_url":"https://call.element.io"}}';
-      '';
-    };
     "/" = {
       proxyPass = "http://127.0.0.1:6167";
     };
@@ -36,25 +30,22 @@ in {
     recommendedGzipSettings = true;
 
     virtualHosts = {
-      # "kylekrein.com" = {
+      "kylekrein.com" = {
-      #  enableACME = true;
+        enableACME = true;
-      # forceSSL = true;
+        forceSSL = true;
-      #locations = config.services.nginx.virtualHosts."matrix.kylekrein.com".locations;
+        locations = config.services.nginx.virtualHosts."matrix.kylekrein.com".locations;
-      #};
+      };
 
-      #"matrix.kylekrein.com" = {
+      "turn.kylekrein.com" = {
-      #  enableACME = true;
+        enableACME = true;
-      #  forceSSL = true;
+        forceSSL = true;
-      #  locations = matrixLocations;
+      };
-      #};
 
-      #"git.kylekrein.com" = {
+      "matrix.kylekrein.com" = {
-      #  enableACME = true;
+        enableACME = true;
-      #  forceSSL = true;
+        forceSSL = true;
-      #  locations."/" = {
+        locations = matrixLocations;
-      #    proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+      };
-      #  };
-      #};
 
       "immich.kylekrein.com" = {
         enableACME = true;