{ flakes, pkgs, lib, config, machineName, ipv4, ... }: let inherit (config) networking; inherit (config.services) coturn; inherit (config.users) users; in { networking.nftables.ruleset = '' add rule inet filter net2fw tcp dport ${toString coturn.listening-port} counter accept comment "TURN" add rule inet filter net2fw udp dport ${toString coturn.listening-port} counter accept comment "TURN" add rule inet filter net2fw tcp dport ${toString coturn.tls-listening-port} counter accept comment "TURN TLS" add rule inet filter net2fw udp dport ${toString coturn.tls-listening-port} counter accept comment "TURN DTLS" add rule inet filter net2fw tcp dport ${toString coturn.alt-listening-port} counter accept comment "STUN" add rule inet filter net2fw udp dport ${toString coturn.alt-listening-port} counter accept comment "STUN" add rule inet filter net2fw udp dport ${toString coturn.min-port}-${toString coturn.max-port} counter accept comment "Coturn" add rule inet filter fw2net meta skuid ${users.turnserver.name} counter accept comment "Coturn" ''; users.groups.acme.members = [ users.turnserver.name ]; security.acme.certs."${networking.domain}" = { postRun = "systemctl try-restart coturn"; }; environment.systemPackages = [pkgs.coturn]; systemd.services.coturn = { wants = [ "acme-selfsigned-${networking.domain}.service" "acme-${networking.domain}.service"]; after = [ "acme-selfsigned-${networking.domain}.service" ]; }; services.coturn = { enable = true; realm = "turn.${networking.domain}"; use-auth-secret = true; static-auth-secret = builtins.readFile (flakes.secrets + "/coturn/static-auth-secret"); pkey = "/var/lib/acme/${networking.domain}/key.pem"; cert = "/var/lib/acme/${networking.domain}/fullchain.pem"; dh-file = flakes.secrets + "/openssl/dh.pem"; listening-ips = [ipv4]; relay-ips = [ipv4]; secure-stun = false; no-cli = false; no-udp = false; no-tcp = false; no-udp-relay = false; no-tcp-relay = false; cli-ip = "127.0.0.1"; cli-password = "none"; extraConfig = '' # Disallow server fingerprinting prod cipher-list="HIGH" no-multicast-peers #fingerprint verbose ''; }; }