Rename nixos-coturn to coturn and finish config

hosts.nix

@@ -51,7 +51,7 @@ in
       hostNixpkgs = nixpkgs-unstable;
       site = "vs";
     };
-    nixos-coturn = {
+    coturn = {
       site = "vs";
     };
     tor-relay = {

hosts/coturn/acme.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  security.acme.certs = {
+    "turn.nekover.se" = {
+      listenHTTP = ":80";
+      group = "turnserver";
+      reloadServices = [ "coturn.service" ];
+    };
+  };
+}

hosts/coturn/configuration.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/vda";
+  };
+
+  networking = {
+    hostName = "coturn";
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ 80 3478 5349 ];
+      allowedUDPPorts = [ 3478 5349 ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+
+  system.stateVersion = "23.05";
+}

hosts/coturn/coturn.nix

@@ -1,17 +1,17 @@
-{ ... }:
+{ config, ... }:
 {
   services.coturn = {
     enable = true;
-
     min-port = 49200;
     max-port = 49500;
     use-auth-secret = true;
     static-auth-secret-file = "/secrets/static-auth-secret.secret";
     realm = "turn.nekover.se";
-    cert = "/certs/turn.nekover.se/fullchain.pem";
-    pkey = "/certs/turn.nekover.se/key.pem";
+    cert = "${config.security.acme.certs."turn.nekover.se".directory}/fullchain.pem";
+    pkey = "${config.security.acme.certs."turn.nekover.se".directory}/key.pem";
     no-tcp-relay = true;
-    extraConfig = "
+    no-cli = true;
+    extraConfig = ''
       external-ip=170.133.2.81/10.202.41.118
       prometheus
       syslog
@@ -40,6 +40,6 @@
 
       user-quota=12
       total-quota=1200
-      ";
+    '';
   };
 }

hosts/coturn/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ./configuration.nix
+    ./acme.nix
     ./coturn.nix
   ];
 }

hosts/nixos-coturn/configuration.nix

@@ -1,14 +0,0 @@
-{ ... }:
-{
-  boot.loader.grub = {
-    enable = true;
-    device = "/dev/vda";
-  };
-
-  networking = {
-    hostName = "coturn";
-    firewall.enable = false;
-  };
-
-  system.stateVersion = "23.05";
-}

hosts/web-public-2/virtualHosts/acme-challenge.nix

@@ -27,4 +27,13 @@
       proxyPass = "http://metrics.vs.grzb.de:80";
     };
   };
+  services.nginx.virtualHosts."turn.nekover.se" = {
+    listen = [{ 
+      addr = "0.0.0.0";
+      port = 80;
+    }];
+    locations."^~ /.well-known/acme-challenge/" = {
+      proxyPass = "http://coturn.vs.grzb.de:80";
+    };
+  };
 }