diff --git a/dns.tf b/dns.tf index 5858815..348ec71 100644 --- a/dns.tf +++ b/dns.tf @@ -175,6 +175,14 @@ resource "hetznerdns_record" "matrix_srv" { ttl = 86400 } +resource "hetznerdns_record" "coturn_a" { + zone_id = data.hetznerdns_zone.banditlair_zone.id + name = "turn" + value = data.hcloud_floating_ip.main_ip.ip_address + type = "A" + ttl = 600 +} + # Email resource "hetznerdns_record" "mail_mx" { zone_id = data.hetznerdns_zone.banditlair_zone.id diff --git a/modules/nginx.nix b/modules/nginx.nix index 9a02b66..aa5bd01 100644 --- a/modules/nginx.nix +++ b/modules/nginx.nix @@ -1,6 +1,7 @@ { pkgs, lib, config, ... }: { security.acme.defaults.email = "letsencrypt.account@banditlair.com"; + security.acme.defaults.webroot = "/var/lib/acme/acme-challenge"; security.acme.acceptTerms = true; services.nginx = { diff --git a/modules/synapse.nix b/modules/synapse.nix index d235075..974011a 100644 --- a/modules/synapse.nix +++ b/modules/synapse.nix @@ -14,6 +14,7 @@ let user: "synapse" password: "SYNAPSE_DB_PASSWORD" macaroon_secret_key: "MACAROON_SECRET_KEY" + turn_shared_secret: "TURN_SHARED_SECRET" ''; in { @@ -82,6 +83,13 @@ in key = "synapse/macaroon_secret_key"; restartUnits = [ "matrix-synapse-setup" ]; }; + turnSharedSecret = { + owner = config.systemd.services.matrix-synapse.serviceConfig.User; + group = "turnserver"; + mode = "0440"; + key = "synapse/turn_shared_secret"; + restartUnits = [ "matrix-synapse-setup" "coturn" ]; + }; }; systemd.services.matrix-synapse-setup = { @@ -92,6 +100,7 @@ in install -m 600 ${synapseDbConfig} /run/synapse/synapse-db-config.yaml ${pkgs.replace-secret}/bin/replace-secret 'SYNAPSE_DB_PASSWORD' '${config.sops.secrets.synapseDbPassword.path}' /run/synapse/synapse-db-config.yaml ${pkgs.replace-secret}/bin/replace-secret 'MACAROON_SECRET_KEY' '${config.sops.secrets.macaroonSecretKey.path}' /run/synapse/synapse-db-config.yaml + ${pkgs.replace-secret}/bin/replace-secret 'TURN_SHARED_SECRET' '${config.sops.secrets.turnSharedSecret.path}' /run/synapse/synapse-db-config.yaml ''; serviceConfig = { @@ -108,7 +117,7 @@ in bindsTo = [ "matrix-synapse-setup.service" ]; }; - services.matrix-synapse = { + services.matrix-synapse = with config.services.coturn; { enable = true; settings = { server_name = config.networking.domain; @@ -128,17 +137,80 @@ in ]; } ]; + database = { name = "psycopg2"; args = { host = "fake"; # This section is overriden by "extraConfigFiles" }; }; + + turn_uris = [ "turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp" ]; + turn_user_lifetime = "1h"; }; - - - dataDir = "/nix/var/data/matrix-synapse"; extraConfigFiles = [ "/run/synapse/synapse-db-config.yaml" ]; }; + + services.coturn = rec { + enable = true; + no-cli = true; + no-tcp-relay = true; + min-port = 49000; + max-port = 50000; + use-auth-secret = true; + static-auth-secret-file = config.sops.secrets.turnSharedSecret.path; + realm = "turn.${config.networking.domain}"; + cert = "${config.security.acme.certs.${realm}.directory}/full.pem"; + pkey = "${config.security.acme.certs.${realm}.directory}/key.pem"; + extraConfig = '' + # for debugging + verbose + # ban private IP ranges + no-multicast-peers + denied-peer-ip=0.0.0.0-0.255.255.255 + denied-peer-ip=10.0.0.0-10.255.255.255 + denied-peer-ip=100.64.0.0-100.127.255.255 + denied-peer-ip=127.0.0.0-127.255.255.255 + denied-peer-ip=169.254.0.0-169.254.255.255 + denied-peer-ip=172.16.0.0-172.31.255.255 + denied-peer-ip=192.0.0.0-192.0.0.255 + denied-peer-ip=192.0.2.0-192.0.2.255 + denied-peer-ip=192.88.99.0-192.88.99.255 + denied-peer-ip=192.168.0.0-192.168.255.255 + denied-peer-ip=198.18.0.0-198.19.255.255 + denied-peer-ip=198.51.100.0-198.51.100.255 + denied-peer-ip=203.0.113.0-203.0.113.255 + denied-peer-ip=240.0.0.0-255.255.255.255 + denied-peer-ip=::1 + denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff + denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255 + denied-peer-ip=100::-100::ffff:ffff:ffff:ffff + denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff + ''; + }; + + networking.firewall = { + interfaces.enp2s0 = + let + range = with config.services.coturn; [{ + from = min-port; + to = max-port; + }]; + in + { + allowedUDPPortRanges = range; + allowedUDPPorts = [ 3478 ]; + allowedTCPPortRanges = range; + allowedTCPPorts = [ 3478 ]; + }; + }; + + security.acme.certs.${config.services.coturn.realm} = { + postRun = "systemctl restart coturn.service"; + group = "turnserver"; + }; } diff --git a/secrets.enc.yml b/secrets.enc.yml index 7f7e38b..14fc5c7 100644 --- a/secrets.enc.yml +++ b/secrets.enc.yml @@ -3,6 +3,7 @@ gitlab: synapse: db_password: ENC[AES256_GCM,data:hy2BgTsRaZDQZULTW/csmnRy5ZjDEuPqxyuINv0ov5pFzDkozJVL1wut3HgBXjYZ8bqNjS5pCPQtkznw,iv:i41zKGwvPGIEZP0ZjhRaY4UMeOXBovQmLr1e1ewZhV4=,tag:3kKKYouH+lOrNxPJE5ul/Q==,type:str] macaroon_secret_key: ENC[AES256_GCM,data:6n1gCit2MC8l4VR9DSUR87BB+hY5Oza33423sbV8sNIXmZsPzhyvxaBalK/0TVjLH6Q=,iv:OgHxNG96ZW4+LPZhLAtOD01Wibad6vSX6s4BrPE67YE=,tag:OGIz/ufUwt8/pUMLvoaXtg==,type:str] + turn_shared_secret: ENC[AES256_GCM,data:vQhMvDeR1y7Nzp1aRjIX2uo09F5H6Mmo0aJIkmYnh5vwMawjynIA2Ldh4onMyZ72lBY=,iv:jWyGGBA0m9q6/buanBkczLY8k85c4UYXrPyJ/Kpmhm4=,tag:qT1LW48mbXk5bPkCXRg83A==,type:str] nextcloud: db_password: ENC[AES256_GCM,data:guuBM5ag+Q014Y+rt0+E9hJcYfLcXV8HfJdbWRuI7BC+Gsjr82OkowFYquFLvcnMAgYWXroy73jW4I4v,iv:KDm/er5h/rK6jqRQdS36LPAw3oOk/yZya0OMPoJlyBg=,tag:4AXG7/BRHOoYJwvVwJxhPw==,type:str] admin_password: ENC[AES256_GCM,data:zTOHKYJmBbA6Tca2l+vO748dGzP2XkAvZHmJtrbftDI5Q/1mS3ZLw16g1DT+pKXF7VIUm2plR7ZRtxwq,iv:87lrQzhdyz1YiIO25fXwn0TvEASm/H8N5cZUckIm780=,tag:VXyNu8CnoY/ShK7dHnPTWA==,type:str] @@ -49,8 +50,8 @@ sops: azure_kv: [] hc_vault: [] age: [] - lastmodified: "2022-07-19T06:19:36Z" - mac: ENC[AES256_GCM,data:3Tu/z60AujniKkVHyQrB26tWRGRg8JxrzEMbCKD67c6snRfkmz6azjWjA8pwCQ2zx4hWqGYywJa9ngIWUqlrdu/4x6RwXTBLwYr7YwqfuuLnLm+c2Kb7Vo4nNu1nnk23BNS7GxYSvP+kjJrshPVwfFcz9SOqNSHFNL3VXVeKS9E=,iv:yA6yz9MKccfFcgwiQ6tdyr7PZH/d/qCGPbIXtnKHmtA=,tag:q99hXi7BeY0troFaOc4YLA==,type:str] + lastmodified: "2022-07-27T00:04:51Z" + mac: ENC[AES256_GCM,data:I1z+7HZP7JEICEGa93mJ1qGysNVBJWyb8LsjuioFdsoKLy4B0wexdpRnB/gNSdEO/D18jAxMfMBwNd5zpI68O7Z0u1tCK0APog2anJYcd3KWMJ0eo5FNk3AsASOUoB/9H4Mcv224MsMyDtCVvxaJ8Ql0HtbfDZu/B0Hxd+kQJgw=,iv:HN65bOS26p3qVtNwP6u27RpdPFD6dobVSxnZhIcAvb4=,tag:3EBGuuq+vKyGn+N4jfp9yA==,type:str] pgp: - created_at: "2021-11-29T00:57:34Z" enc: | diff --git a/shell.nix b/shell.nix index 57688eb..a3a8864 100644 --- a/shell.nix +++ b/shell.nix @@ -1,10 +1,10 @@ -( - import ( +(import + ( fetchTarball { - url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz"; - sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2"; + url = "https://github.com/edolstra/flake-compat/archive/b4a34015c698c7793d592d66adbab377907a2be8.tar.gz"; + sha256 = "1qc703yg0babixi6wshn5wm2kgl5y1drcswgszh4xxzbrwkk9sv7"; } - ) { + ) + { src = ./.; - } -).shellNix + }).shellNix