Initial commit

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

services/coturn.nix

@@ -0,0 +1,72 @@
+{ config, pkgs, ... }:
+
+{
+  sops.secrets."coturn/auth_secret_vps" = {
+    sopsFile = ./secrets/coturn_vps.yaml;
+    mode = "0400";
+    owner = "turnserver";
+    group = "turnserver";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "wizzeh@protonmail.com";
+    certs."turn.ellie.town" = {
+      webroot = "/var/lib/acme/acme-challenges";
+    };
+    certs."ellie.town" = { };
+  };
+
+  networking.firewall = {
+    allowedUDPPorts = [
+      3478
+      5349
+    ];
+    allowedTCPPorts = [
+      3478
+      5349
+      80
+      443
+    ];
+    allowedUDPPortRanges = [
+      {
+        from = 49152;
+        to = 65535;
+      }
+    ];
+  };
+
+  services.coturn = {
+    enable = true;
+
+    realm = "turn.ellie.town";
+
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets."coturn/auth_secret_vps".path;
+
+    cert = "/var/lib/acme/turn.ellie.town/fullchain.pem";
+    pkey = "/var/lib/acme/turn.ellie.town/key.pem";
+
+    listening-ips = [
+      "0.0.0.0"
+      "::"
+    ];
+    listening-port = 3478;
+    tls-listening-port = 5349;
+
+    lt-cred-mech = true;
+    no-tcp-relay = true;
+
+    min-port = 49152;
+    max-port = 65535;
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."turn.ellie.town" = {
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/acme-challenges";
+      };
+    };
+  };
+}