mirror of https://gitlab.crans.org/nounous/nixos
123 lines
2.8 KiB
Nix
123 lines
2.8 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
keyFile = "/run/livekit.key";
|
|
domain = "livekit.crans.org";
|
|
in
|
|
{
|
|
services.livekit' = {
|
|
enable = true;
|
|
|
|
openFirewall = true;
|
|
|
|
settings = {
|
|
port = 8100;
|
|
|
|
room.auto_create = true;
|
|
|
|
rtc = {
|
|
use_external_ip = false;
|
|
node_ip = config.crans.networking.srv.ipv4;
|
|
tcp_port = 8101;
|
|
port_range_start = 50000;
|
|
port_range_end = 52000;
|
|
enable_loopback_candidate = false;
|
|
turn_servers = [
|
|
{
|
|
host = config.services.coturn.realm;
|
|
port = 3478;
|
|
protocol = "tcp";
|
|
secretFile = config.age.secrets.coturn_auth_secret.path;
|
|
}
|
|
{
|
|
host = config.services.coturn.realm;
|
|
port = 3478;
|
|
protocol = "udp";
|
|
secretFile = config.age.secrets.coturn_auth_secret.path;
|
|
}
|
|
{
|
|
host = config.services.coturn.realm;
|
|
port = 5349;
|
|
protocol = "tls";
|
|
secretFile = config.age.secrets.coturn_auth_secret.path;
|
|
}
|
|
];
|
|
};
|
|
|
|
turn.enabled = false;
|
|
};
|
|
|
|
inherit keyFile;
|
|
};
|
|
|
|
networking.firewall =
|
|
let
|
|
range = with config.services.livekit'.settings.rtc; lib.singleton {
|
|
from = port_range_start;
|
|
to = port_range_end;
|
|
};
|
|
in
|
|
{
|
|
allowedUDPPortRanges = range;
|
|
allowedUDPPorts = [ 8100 8101 8102 ];
|
|
allowedTCPPortRanges = range;
|
|
allowedTCPPorts = [ 8100 8101 8102 ];
|
|
};
|
|
|
|
users.users.livekit.extraGroups = [ "turnserver" ];
|
|
|
|
services.lk-jwt-service = {
|
|
enable = true;
|
|
port = 8102;
|
|
|
|
livekitUrl = "wss://${domain}";
|
|
|
|
inherit keyFile;
|
|
};
|
|
|
|
systemd.services.livekit-key = {
|
|
before = [
|
|
"lk-jwt-service.service"
|
|
"livekit.service"
|
|
];
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
path = with pkgs; [
|
|
livekit
|
|
coreutils
|
|
gawk
|
|
];
|
|
|
|
script = ''
|
|
echo "Key missing, generating key"
|
|
echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${keyFile}"
|
|
'';
|
|
serviceConfig.Type = "oneshot";
|
|
unitConfig.ConditionPathExists = "!${keyFile}";
|
|
};
|
|
|
|
systemd.services.lk-jwt-service.environment.LIVEKIT_FULL_ACCESS_HOMESERVERS = "crans.org";
|
|
|
|
services.nginx.virtualHosts."${domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
locations."~ /(get_token|healthz|sfu/get)" = {
|
|
proxyPass = "http://localhost:${toString config.services.lk-jwt-service.port}";
|
|
};
|
|
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:${toString config.services.livekit'.settings.port}";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
|
|
age.secrets = {
|
|
autofocus-config = {
|
|
file = ../../../secrets/zora/services/autofocus-config.age;
|
|
mode = "444";
|
|
};
|
|
};
|
|
}
|