Add Cotrun so matrix calls can work behind NAT

dns.tf

@@ -175,6 +175,14 @@ resource "hetznerdns_record" "matrix_srv" {
   ttl     = 86400
 }
 
+resource "hetznerdns_record" "coturn_a" {
+  zone_id = data.hetznerdns_zone.banditlair_zone.id
+  name    = "turn"
+  value   = data.hcloud_floating_ip.main_ip.ip_address
+  type    = "A"
+  ttl     = 600
+}
+
 # Email
 resource "hetznerdns_record" "mail_mx" {
   zone_id = data.hetznerdns_zone.banditlair_zone.id

modules/nginx.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }:
 {
   security.acme.defaults.email = "letsencrypt.account@banditlair.com";
+  security.acme.defaults.webroot = "/var/lib/acme/acme-challenge";
   security.acme.acceptTerms = true;
 
   services.nginx = {

modules/synapse.nix

@@ -14,6 +14,7 @@ let
           user: "synapse"
           password: "SYNAPSE_DB_PASSWORD"
     macaroon_secret_key: "MACAROON_SECRET_KEY"
+    turn_shared_secret: "TURN_SHARED_SECRET"
   '';
 in
 {
@@ -82,6 +83,13 @@ in
       key = "synapse/macaroon_secret_key";
       restartUnits = [ "matrix-synapse-setup" ];
     };
+    turnSharedSecret = {
+      owner = config.systemd.services.matrix-synapse.serviceConfig.User;
+      group = "turnserver";
+      mode = "0440";
+      key = "synapse/turn_shared_secret";
+      restartUnits = [ "matrix-synapse-setup" "coturn" ];
+    };
   };
 
   systemd.services.matrix-synapse-setup = {
@@ -92,6 +100,7 @@ in
       install -m 600 ${synapseDbConfig} /run/synapse/synapse-db-config.yaml
       ${pkgs.replace-secret}/bin/replace-secret 'SYNAPSE_DB_PASSWORD' '${config.sops.secrets.synapseDbPassword.path}' /run/synapse/synapse-db-config.yaml
       ${pkgs.replace-secret}/bin/replace-secret 'MACAROON_SECRET_KEY' '${config.sops.secrets.macaroonSecretKey.path}' /run/synapse/synapse-db-config.yaml
+      ${pkgs.replace-secret}/bin/replace-secret 'TURN_SHARED_SECRET' '${config.sops.secrets.turnSharedSecret.path}' /run/synapse/synapse-db-config.yaml
     '';
 
     serviceConfig = {
@@ -108,7 +117,7 @@ in
     bindsTo = [ "matrix-synapse-setup.service" ];
   };
 
-  services.matrix-synapse = {
+  services.matrix-synapse = with config.services.coturn; {
     enable = true;
     settings = {
       server_name = config.networking.domain;
@@ -128,17 +137,80 @@ in
           ];
         }
       ];
+
       database = {
         name = "psycopg2";
         args = {
           host = "fake"; # This section is overriden by "extraConfigFiles"
         };
       };
+
+      turn_uris = [ "turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp" ];
+      turn_user_lifetime = "1h";
     };
-
-
-
     dataDir = "/nix/var/data/matrix-synapse";
     extraConfigFiles = [ "/run/synapse/synapse-db-config.yaml" ];
   };
+
+  services.coturn = rec {
+    enable = true;
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49000;
+    max-port = 50000;
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets.turnSharedSecret.path;
+    realm = "turn.${config.networking.domain}";
+    cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    extraConfig = ''
+      # for debugging
+      verbose
+      # ban private IP ranges
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+
+  networking.firewall = {
+    interfaces.enp2s0 =
+      let
+        range = with config.services.coturn; [{
+          from = min-port;
+          to = max-port;
+        }];
+      in
+      {
+        allowedUDPPortRanges = range;
+        allowedUDPPorts = [ 3478 ];
+        allowedTCPPortRanges = range;
+        allowedTCPPorts = [ 3478 ];
+      };
+  };
+
+  security.acme.certs.${config.services.coturn.realm} = {
+    postRun = "systemctl restart coturn.service";
+    group = "turnserver";
+  };
 }

secrets.enc.yml

@@ -3,6 +3,7 @@ gitlab:
 synapse:
     db_password: ENC[AES256_GCM,data:hy2BgTsRaZDQZULTW/csmnRy5ZjDEuPqxyuINv0ov5pFzDkozJVL1wut3HgBXjYZ8bqNjS5pCPQtkznw,iv:i41zKGwvPGIEZP0ZjhRaY4UMeOXBovQmLr1e1ewZhV4=,tag:3kKKYouH+lOrNxPJE5ul/Q==,type:str]
     macaroon_secret_key: ENC[AES256_GCM,data:6n1gCit2MC8l4VR9DSUR87BB+hY5Oza33423sbV8sNIXmZsPzhyvxaBalK/0TVjLH6Q=,iv:OgHxNG96ZW4+LPZhLAtOD01Wibad6vSX6s4BrPE67YE=,tag:OGIz/ufUwt8/pUMLvoaXtg==,type:str]
+    turn_shared_secret: ENC[AES256_GCM,data:vQhMvDeR1y7Nzp1aRjIX2uo09F5H6Mmo0aJIkmYnh5vwMawjynIA2Ldh4onMyZ72lBY=,iv:jWyGGBA0m9q6/buanBkczLY8k85c4UYXrPyJ/Kpmhm4=,tag:qT1LW48mbXk5bPkCXRg83A==,type:str]
 nextcloud:
     db_password: ENC[AES256_GCM,data:guuBM5ag+Q014Y+rt0+E9hJcYfLcXV8HfJdbWRuI7BC+Gsjr82OkowFYquFLvcnMAgYWXroy73jW4I4v,iv:KDm/er5h/rK6jqRQdS36LPAw3oOk/yZya0OMPoJlyBg=,tag:4AXG7/BRHOoYJwvVwJxhPw==,type:str]
     admin_password: ENC[AES256_GCM,data:zTOHKYJmBbA6Tca2l+vO748dGzP2XkAvZHmJtrbftDI5Q/1mS3ZLw16g1DT+pKXF7VIUm2plR7ZRtxwq,iv:87lrQzhdyz1YiIO25fXwn0TvEASm/H8N5cZUckIm780=,tag:VXyNu8CnoY/ShK7dHnPTWA==,type:str]
@@ -49,8 +50,8 @@ sops:
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2022-07-19T06:19:36Z"
+    lastmodified: "2022-07-27T00:04:51Z"
-    mac: ENC[AES256_GCM,data:3Tu/z60AujniKkVHyQrB26tWRGRg8JxrzEMbCKD67c6snRfkmz6azjWjA8pwCQ2zx4hWqGYywJa9ngIWUqlrdu/4x6RwXTBLwYr7YwqfuuLnLm+c2Kb7Vo4nNu1nnk23BNS7GxYSvP+kjJrshPVwfFcz9SOqNSHFNL3VXVeKS9E=,iv:yA6yz9MKccfFcgwiQ6tdyr7PZH/d/qCGPbIXtnKHmtA=,tag:q99hXi7BeY0troFaOc4YLA==,type:str]
+    mac: ENC[AES256_GCM,data:I1z+7HZP7JEICEGa93mJ1qGysNVBJWyb8LsjuioFdsoKLy4B0wexdpRnB/gNSdEO/D18jAxMfMBwNd5zpI68O7Z0u1tCK0APog2anJYcd3KWMJ0eo5FNk3AsASOUoB/9H4Mcv224MsMyDtCVvxaJ8Ql0HtbfDZu/B0Hxd+kQJgw=,iv:HN65bOS26p3qVtNwP6u27RpdPFD6dobVSxnZhIcAvb4=,tag:3EBGuuq+vKyGn+N4jfp9yA==,type:str]
     pgp:
         - created_at: "2021-11-29T00:57:34Z"
           enc: |

shell.nix

@@ -1,10 +1,10 @@
+(import
   (
-  import (
     fetchTarball {
-      url = "https://github.com/edolstra/flake-compat/archive/99f1c2157fba4bfe6211a321fd0ee43199025dbf.tar.gz";
+      url = "https://github.com/edolstra/flake-compat/archive/b4a34015c698c7793d592d66adbab377907a2be8.tar.gz";
-      sha256 = "0x2jn3vrawwv9xp15674wjz9pixwjyj3j771izayl962zziivbx2";
+      sha256 = "1qc703yg0babixi6wshn5wm2kgl5y1drcswgszh4xxzbrwkk9sv7";
     }
-  ) {
+  )
+  {
     src = ./.;
-  }
+  }).shellNix
-).shellNix