WIP: matrix: Add coturn support for calls

configuration/default.nix

@@ -50,17 +50,36 @@
     useDHCP = false;
     interfaces.eth0.useDHCP = true;
 
-    firewall.allowedTCPPorts = [
-      # http
-      80
-      443
-      # ssh
-      2222
-      # matrix
-      8448
-      # starbound
-      21025
-    ];
+    firewall = {
+      allowedTCPPorts = [
+        # http
+        80
+        443
+        # ssh
+        2222
+        # matrix
+        8448
+        # starbound
+        21025
+
+        # TURN (for matrix calls)
+        config.services.coturn.listening-port
+        config.services.coturn.tls-listening-port
+      ];
+
+      allowedUDPPorts = [
+        # TURN (for matrix calls)
+        config.services.coturn.listening-port
+        config.services.coturn.tls-listening-port
+      ];
+
+      allowedUDPPortRanges = [
+        {
+          from = config.services.coturn.min-port;
+          to = config.services.coturn.max-port;
+        }
+      ];
+    };
   };
 
   time.timeZone = "Europe/London";

configuration/services/conduit.nix

@@ -1,6 +1,7 @@
 {config, ...}: let
   cfg = config.services.matrix-conduit;
   domain = "matrix.${config.services.nginx.domain}";
+  turn-realm = "turn.${config.services.nginx.domain}";
 in {
   services.matrix-conduit = {
     enable = true;
@@ -8,9 +9,43 @@ in {
       address = "127.0.0.1";
       server_name = domain;
       database_backend = "rocksdb";
+
+      turn_uris = ["turn:turn.tlater.net?transport=udp" "turn:turn.tlater.net?transport=tcp"];
     };
   };
 
+  # Pass in the TURN secret via EnvironmentFile, not supported by
+  # upstream module currently.
+  #
+  # See also https://gitlab.com/famedly/conduit/-/issues/314
+  systemd.services.conduit.serviceConfig.EnvironmentFile = config.sops.secrets."turn/env".path;
+
+  services.coturn = {
+    enable = true;
+    use-auth-secret = true;
+    static-auth-secret-file = config.sops.secrets."turn/secret".path;
+    realm = turn-realm;
+
+    # Based on suggestions from https://github.com/matrix-org/synapse/blob/develop/docs/turn-howto.md
+    no-tcp-relay = true;
+    extraConfig = ''
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      allowed-peer-ip=127.0.0.1
+      user-quota=12
+      total-quota=36
+    '';
+  };
+
   services.nginx.virtualHosts."${domain}" = {
     enableACME = true;
 

configuration/sops.nix

@@ -6,5 +6,7 @@
       group = "nextcloud";
     };
     secrets."steam/tlater" = {};
+    secrets."turn/env" = {};
+    secrets."turn/secret" = {};
   };
 }