crans
/
nixos
mirror of https://gitlab.crans.org/nounous/nixos
19
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Finalisation configuration matrix

neo
pigeonmoelleux 2025-01-18 15:34:43 +01:00 committed by RatCornu
parent 29bc3235bb
commit 8225478bc0
No known key found for this signature in database
GPG Key ID: B3BE02E379E6E8E2
4 changed files with 77 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
hosts/vm/neo/default.nix
View File

@ -6,6 +6,7 @@
./networking.nix
../../../modules
../../../modules/services/coturn.nix
../../../modules/services/matrix.nix
];

28
hosts/vm/neo/networking.nix
View File

@ -21,43 +21,29 @@
}
];
};
};
ens19 = {
ipv4 = {
addresses = [
{
address = "185.230.79.38";
prefixLength = 26;
address = "172.16.3.141";
prefixLength = 24;
}
];
routes = [
{
address = "0.0.0.0";
via = "185.230.79.62";
prefixLength = 0;
}
];
};
ipv6 = {
addresses = [
{
address = "2a0c:700:2::ff:fe01:3702";
prefixLength = 64;
}
];
routes = [
{
address = "::";
via = "2a0c:700:2::ff:fe00:9902";
via = "172.16.3.99";
prefixLength = 0;
}
];
};
};
};
firewall = {
enable = true;
};
};
}

63
modules/services/coturn.nix 100644
View File

@ -0,0 +1,63 @@
{ config, ... }:
{
sops.secrets.coturn-auth-secret = {
sopsFile = ../../secrets/neo.yaml;
};
services.coturn = {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
static-auth-secret-file = config.sops.secrets.coturn-auth-secret.path;
realm = "crans.org";
cert = "/var/lib/acme/crans.org/full.pem";
pkey = "/var/lib/acme/crans.org/key.pem";
extraConfig = ''
verbose
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
'';
};
networking.firewall = {
allowedTCPPorts = [
3478
5349
];
allowedUDPPorts = [
3478
5349
];
allowedUDPPortRanges = [
{
from = config.services.coturn.min-port;
to = config.services.coturn.max-port;
}
];
};
}

6
modules/services/matrix.nix
View File

@ -15,10 +15,13 @@
matrix_appservice_irc_db = {
sopsFile = ../../secrets/neo.yaml;
};
<<<<<<< HEAD
coturn_auth_secret = {
sopsFile = ../../secrets/neo.yaml;
};
=======
>>>>>>> 8e15aad (Finalisation configuration matrix)
};
networking.firewall = {
@ -101,7 +104,10 @@
"turn:${config.services.coturn.realm}:3478?transport=udp"
"turn:${config.services.coturn.realm}:3478?transport=tcp"
];
<<<<<<< HEAD
turn_shared_secret = config.sops.secrets.coturn_auth_secret.path;
=======
>>>>>>> 8e15aad (Finalisation configuration matrix)
turn_user_lifetime = "1h";
app_service_config_files = [