configuration/services/conduit.nix

@@ -1,4 +1,10 @@
-{config, ...}: let
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib.strings) concatMapStringsSep;
+
   cfg = config.services.matrix-conduit;
   domain = "matrix.${config.services.nginx.domain}";
   turn-realm = "turn.${config.services.nginx.domain}";
@@ -16,8 +22,6 @@ in {
       in [
         "turn:${address}?transport=udp"
         "turn:${address}?transport=tcp"
-        "turns:${tls-address}?transport=udp"
-        "turns:${tls-address}?transport=tcp"
       ];
     };
   };
@@ -68,11 +72,9 @@ in {
       denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
       denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
       denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
-      allowed-peer-ip=178.79.137.55
 
-      # Limit number of rooms
-      user-quota=12
-      total-quota=36
+      # *Allow* any IP addresses that we explicitly set as relay IPs
+      ${concatMapStringsSep "\n" (ip: "allowed-peer-ip=${ip}") config.services.coturn.relay-ips}
 
       # Various other security settings
       no-tlsv1

flake.nix

@@ -72,13 +72,15 @@
       lib = nixpkgs.lib;
     };
 
-    ####################
-    # VM launch script #
-    ####################
-    apps.${system} = let
+    ###################
+    # Utility scripts #
+    ###################
+    packages.${system} = let
       inherit (nixpkgs.legacyPackages.${system}) writeShellScript;
     in {
-      default = let
+      default = self.packages.${system}.run-vm;
+
+      run-vm = let
         vm = self.lib.makeNixosSystem {
           inherit system;
           extraModules = [(import ./configuration/hardware-specific/vm.nix)];
@@ -91,23 +93,33 @@
           "8448" = "8448"; # Matrix
           "21025" = "21025"; # Starbound
         };
-      in {
-        type = "app";
-        program = builtins.toString (writeShellScript "run-vm" ''
+      in
+        writeShellScript "run-vm" ''
           export QEMU_OPTS="-m 3941 -smp 2 -display curses"
           export QEMU_NET_OPTS="${qemuNetOpts}"
           "${vm.config.system.build.vm}/bin/run-tlaternet-vm"
-        '');
-      };
+        '';
 
       update-nextcloud-apps = let
         nvfetcher-bin = "${nvfetcher.defaultPackage.${system}}/bin/nvfetcher";
-      in {
-        type = "app";
-        program = builtins.toString (writeShellScript "update-nextcloud-apps" ''
+      in
+        writeShellScript "update-nextcloud-apps" ''
           cd "$(git rev-parse --show-toplevel)/pkgs"
           ${nvfetcher-bin} -o _sources_nextcloud -c nextcloud-apps.toml
-        '');
+        '';
+    };
+
+    apps.${system} = let
+      inherit (nixpkgs.legacyPackages.${system}) writeShellScript;
+    in {
+      default = {
+        type = "app";
+        program = builtins.toString self.packages.${system}.run-vm;
+      };
+
+      update-nextcloud-apps = {
+        type = "app";
+        program = builtins.toString self.packages.${system}.update-nextcloud-apps;
       };
     };