wizzy/home-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: wizzy:6843931e4b5990beb6776daa1669edc8b8493131
Branches Tags
wizzy:master
..
compare: wizzy:b90f98eb64a3f739aed251f55ce6e62ac23f729f
Branches Tags
wizzy:master

No commits in common. "6843931e4b5990beb6776daa1669edc8b8493131" and "b90f98eb64a3f739aed251f55ce6e62ac23f729f" have entirely different histories.
6843931e4b ... b90f98eb64

6 changed files with 0 additions and 184 deletions
Download patch file Download diff file Expand all files Collapse all files

2
flake.nix
View file

@ -86,8 +86,6 @@
./services/nginx.nix
./services/blog.nix
./services/coturn.nix
./services/livekit.nix
./services/lk-jwt.nix
./services/wireguard-outer.nix
./services/borgbackup-vps.nix
];

1
result
View file

@ -1 +0,0 @@
/nix/store/252q6jdcng8my1dsrxb8j5klf1yzaikp-nixos-system-nixos-25.11.20260329.107cba9

70
services/livekit.nix
View file

@ -1,70 +0,0 @@
{ config, pkgs, ... }:
{
sops.secrets."livekit/api_key" = {
sopsFile = ./secrets/livekit_vps.yaml;
mode = "0400";
owner = "livekit";
group = "livekit";
};
sops.secrets."livekit/api_secret" = {
sopsFile = ./secrets/livekit_vps.yaml;
mode = "0400";
owner = "livekit";
group = "livekit";
};
users.users.livekit = {
isSystemUser = true;
group = "livekit";
};
users.groups.livekit = { };
# WebRTC media (UDP) and ICE TCP fallback. HTTP signaling goes through nginx.
networking.firewall = {
allowedTCPPorts = [ 7881 ];
allowedUDPPortRanges = [
{
from = 50000;
to = 50200;
}
];
};
systemd.services.livekit = {
description = "LiveKit SFU server";
wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
User = "livekit";
Group = "livekit";
RuntimeDirectory = "livekit";
Restart = "always";
RestartSec = 5;
};
script = ''
API_KEY=$(cat ${config.sops.secrets."livekit/api_key".path})
API_SECRET=$(cat ${config.sops.secrets."livekit/api_secret".path})
cat > /run/livekit/config.yaml <<YAML
port: 7880
bind_addresses:
- "127.0.0.1"
rtc:
port_range_start: 50000
port_range_end: 50200
use_external_ip: true
tcp_port: 7881
logging:
level: info
keys:
$API_KEY: $API_SECRET
YAML
exec ${pkgs.livekit}/bin/livekit-server --config /run/livekit/config.yaml
'';
};
}

60
services/lk-jwt.nix
View file

@ -1,60 +0,0 @@
{ config, pkgs, lib, ... }:
let
# lk-jwt-service isn't in nixpkgs — build from source.
# On first `nix build`, the fake hashes will fail and print the correct ones.
lk-jwt-service = pkgs.buildGoModule {
pname = "lk-jwt-service";
version = "0.3.0";
src = pkgs.fetchFromGitHub {
owner = "element-hq";
repo = "lk-jwt-service";
rev = "v0.3.0";
hash = "sha256-fA33LZkozPTng47kunXWkfUExVbMZsiL8Dtkm1hLV6U=";
};
vendorHash = "sha256-0A9pd+PAsGs4KS2BnCxc7PAaUAV3Z+XKNqSrmYvxNeM=";
meta.mainProgram = "lk-jwt-service";
};
in
{
sops.secrets."livekit/api_key" = {
sopsFile = ./secrets/livekit_vps.yaml;
mode = "0400";
owner = "livekit";
group = "livekit";
};
sops.secrets."livekit/api_secret" = {
sopsFile = ./secrets/livekit_vps.yaml;
mode = "0400";
owner = "livekit";
group = "livekit";
};
systemd.services.lk-jwt = {
description = "LiveKit JWT service for Matrix OpenID token exchange";
wantedBy = [ "multi-user.target" ];
after = [
"network-online.target"
"livekit.service"
];
wants = [ "network-online.target" ];
serviceConfig = {
User = "livekit";
Group = "livekit";
Restart = "always";
RestartSec = 5;
};
environment = {
LIVEKIT_URL = "wss://livekit.ellie.town";
LK_JWT_PORT = "8080";
};
script = ''
export LIVEKIT_KEY_FROM_FILE=${config.sops.secrets."livekit/api_key".path}
export LIVEKIT_SECRET_FROM_FILE=${config.sops.secrets."livekit/api_secret".path}
exec ${lk-jwt-service}/bin/lk-jwt-service
'';
};
}

18
services/secrets/livekit_vps.yaml
View file

@ -1,18 +0,0 @@
livekit:
api_key: ENC[AES256_GCM,data:zD2FsmXwMR6A,iv:lPkUgWv6lmBsE6ASJbLkF99AhhOZXw/fjEDgehvdmKs=,tag:OfnqmoXJM/hVuNo1Iv5eew==,type:str]
api_secret: ENC[AES256_GCM,data:HwBLo3/BfMnMtkyYHUYGtCXvZ+IHwQX22otrfVe9895dQR45QgMTJfMDogE=,iv:xyqh45uZdLza+zQURnfaAAtS+hGKrDcVF3nL8TFFtus=,tag:btA+bHwVKwzX71mqZvzfKA==,type:str]
sops:
age:
- recipient: age1856wmagg3dz4j07alwqnn6d75655t6wcs8glklyjyezhu5p875fq9sez4p
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0d1VYdWI0TEZtaStvUml6
NEdYS0gvbUlMTVRpY2xna3BRT2ZINkpLZG53CkNrcDNHUjc4Zm43NnhJKzc0UjBX
RTVrQ3hYWFVzdlJ5Zkh6ZWJkZi9CZUEKLS0tIDZuUjNQWmJXSlZqdGQySXNKV3F1
UXNYWktWUktGQWhpeThvOUFNUlFHWGcKvoGymssPBN5yQwpq2HTHYeNt5VnA1pKe
fyJ0mbwMq+/ZW88HE4vpUY8zONC0QCGprxysMVgsRpXFBfFKk0pjcQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-01T21:18:12Z"
mac: ENC[AES256_GCM,data:E4NwepDYNcwhusfuRFebEXyGQcwlhfvddMDWF3JfUAOERvZnmmY5+OMQc/qbF114r3UYvZr3qX1WgsFE4n4YiuGPFY+E5m4/6PV//Lwe4p5GWGto1fPMN7n2jB+Y1RJn+wP18pjvrIc9onaSgiOuP8eFijp1vZ6hX7kZ2lrEdrI=,iv:SP235ndbodZlpv+RwIKw/U6+XyDwJhjfF53pROWMlI0=,tag:4cWULyYdnJKyjxk+7bkkQg==,type:str]
unencrypted_suffix: _unencrypted
version: 3.12.1

33
services/wireguard-outer.nix
View file

@ -60,34 +60,6 @@
};
};
virtualHosts."livekit.ellie.town" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:7880";
proxyWebsockets = true;
extraConfig = ''
proxy_read_timeout 86400;
'';
};
};
virtualHosts."lk-jwt.ellie.town" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8080";
extraConfig = ''
add_header Access-Control-Allow-Origin * always;
add_header Access-Control-Allow-Methods "POST, OPTIONS" always;
add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
if ($request_method = OPTIONS) {
return 204;
}
'';
};
};
# virtualHosts."akkoma.ellie.town" = {
# enableACME = true;
# forceSSL = true;
@ -159,11 +131,6 @@
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"m.homeserver":{"base_url":"https://matrix.ellie.town"}}';'';
locations."= /.well-known/element/call.json".extraConfig = ''
default_type application/json;
add_header Access-Control-Allow-Origin *;
return 200 '{"type":"livekit","livekit_service_url":"https://lk-jwt.ellie.town"}';'';
};
};