WIP: conduit: Enable turns with a ZeroSSL-provided certificate

configuration/default.nix

@@ -63,14 +63,6 @@
         8448
         # starbound
         21025
-
-        config.services.coturn.listening-port
-        config.services.coturn.tls-listening-port
-      ];
-
-      allowedUDPPorts = [
-        config.services.coturn.listening-port
-        config.services.coturn.tls-listening-port
       ];
 
       allowedUDPPortRanges = [

configuration/services/conduit.nix

@@ -17,11 +17,10 @@ in {
       database_backend = "rocksdb";
 
       turn_uris = let
-        address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}";
         tls-address = "${config.services.coturn.realm}:${toString config.services.coturn.tls-listening-port}";
       in [
-        "turn:${address}?transport=udp"
-        "turn:${address}?transport=tcp"
+        "turns:${tls-address}?transport=udp"
+        "turns:${tls-address}?transport=tcp"
       ];
     };
   };
@@ -34,6 +33,7 @@ in {
 
   services.coturn = {
     enable = true;
+    no-cli = true;
     use-auth-secret = true;
     static-auth-secret-file = config.sops.secrets."turn/secret".path;
     realm = turn-realm;
@@ -41,6 +41,16 @@ in {
       "178.79.137.55"
     ];
 
+    # Use FTPS port to circumvent firewall blocks
+    tls-listening-port = 989;
+
+    # SSL config
+    #
+    # TODO(tlater): Switch to letsencrypt once google fix:
+    #  https://github.com/vector-im/element-android/issues/1533
+    pkey = config.sops.secrets."turn/ssl-key".path;
+    cert = config.sops.secrets."turn/ssl-cert".path;
+
     # Based on suggestions from
     # https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
     # and
@@ -82,7 +92,7 @@ in {
     '';
   };
 
-  services.nginx.virtualHosts."${domain}" = {
+  virtualHosts."${domain}" = {
     enableACME = true;
 
     listen = [

configuration/sops.nix

@@ -10,5 +10,11 @@
     secrets."turn/secret" = {
       owner = "turnserver";
     };
+    secrets."turn/ssl-key" = {
+      owner = "turnserver";
+    };
+    secrets."turn/ssl-cert" = {
+      owner = "turnserver";
+    };
   };
 }