depot/ops/nixos/bvm-prosody/default.nix

134 lines
3.6 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
2021-04-02 00:52:45 +00:00
{ config, depot, pkgs, ... }:
2022-04-09 20:51:24 +00:00
{
imports = [
../lib/bvm.nix
2022-06-19 20:01:55 +00:00
./eventphone-asterisk.nix
];
# Networking!
networking = {
hostName = "bvm-prosody";
hostId = "5c62ee63";
interfaces.enp1s0 = {
ipv4.addresses = [{ address = "10.100.0.202"; prefixLength = 23; }];
};
2021-04-01 15:50:27 +00:00
interfaces.enp6s0 = {
ipv4.addresses = [{ address = "92.118.28.3"; prefixLength = 24; }];
ipv6.addresses = [{ address = "2a09:a441::3"; prefixLength = 32; }];
};
2021-04-01 15:55:54 +00:00
defaultGateway = { address = "92.118.28.1"; interface = "enp6s0"; };
defaultGateway6 = { address = "2a09:a441::1"; interface = "enp6s0"; };
2021-04-02 00:52:45 +00:00
firewall.allowedUDPPorts = [ 3478 ];
firewall.allowedTCPPorts = [ 80 443 3478 5280 5281 5222 5223 5269 5298 ];
};
2021-03-28 14:33:54 +00:00
my.ip.tailscale = "100.86.22.44";
2021-03-28 22:46:55 +00:00
services.coturn = {
enable = true;
use-auth-secret = true;
realm = "turn.lukegb.com";
2022-04-09 20:51:24 +00:00
static-auth-secret-file = config.my.vault.secrets.turn.path;
cert = "/var/lib/acme/turn.lukegb.com/fullchain.pem";
pkey = "/var/lib/acme/turn.lukegb.com/privkey.pem";
2021-04-02 00:52:45 +00:00
};
2022-04-09 20:51:24 +00:00
my.vault.secrets.turn = {
restartUnits = ["coturn.service"];
group = "turnserver";
template = ''
{{- with secret "kv/apps/turn" -}}
{{ .Data.data.secret }}
{{- end -}}
'';
};
my.vault.secrets.turn-prosody = {
restartUnits = ["prosody.service"];
group = "prosody";
template = ''
{{- with secret "kv/apps/turn" -}}
{{ .Data.data.secret }}
{{- end -}}
'';
};
2021-04-02 00:52:45 +00:00
services.prosody = {
enable = true;
admins = [ "admin@lukegb.com" "lukegb@lukegb.com" ];
virtualHosts."lukegb.com" = {
enabled = true;
domain = "lukegb.com";
ssl.cert = "/var/lib/acme/xmpp.lukegb.com/fullchain.pem";
ssl.key = "/var/lib/acme/xmpp.lukegb.com/privkey.pem";
2021-04-02 00:52:45 +00:00
};
muc = [{
domain = "muc.xmpp.lukegb.com";
}];
2022-03-11 03:27:58 +00:00
uploadHttp = {
domain = "upload.xmpp.lukegb.com";
};
ssl.cert = "/var/lib/acme/xmpp.lukegb.com/fullchain.pem";
ssl.key = "/var/lib/acme/xmpp.lukegb.com/privkey.pem";
2021-04-02 00:52:45 +00:00
extraConfig = ''
2022-05-02 16:20:03 +00:00
storage = "sql"
sql = {
driver = "SQLite3";
database = "prosody.db";
}
2021-10-22 18:39:32 +00:00
archive_expires_after = "never" -- keep messages forever
2021-04-02 00:52:45 +00:00
proxy65_address = "xmpp.lukegb.com"
proxy65_acl = { "lukegb.com" }
component_ports = { 5347 }
component_interface = { "127.0.0.1", "::1" }
legacy_ssl_ports = { 5223 }
2022-04-09 20:51:24 +00:00
local turn_secret_file = io.open("${config.my.vault.secrets.turn-prosody.path}", "r")
local turn_secret = turn_secret_file:read()
turn_secret_file:close()
2021-04-02 00:52:45 +00:00
external_services = {
{
type = "stun",
transport = "udp",
host = "turn.lukegb.com",
port = 3478,
}, {
type = "turn",
transport = "udp",
host = "turn.lukegb.com",
port = 3478,
2022-04-09 20:51:24 +00:00
secret = turn_secret,
2021-04-02 00:52:45 +00:00
}
}
2022-06-19 20:01:55 +00:00
Component "asterisk.lukegb.com"
component_secret = "thisisasampleofspeex"
2021-04-02 00:52:45 +00:00
'';
};
my.vault.acmeCertificates = {
"xmpp.lukegb.com" = {
2021-04-02 00:52:45 +00:00
group = "prosody";
hostnames = [ "xmpp.lukegb.com" "*.xmpp.lukegb.com" "lukegb.com" ];
reloadOrRestartUnits = [ "prosody.service" ];
2021-04-02 00:52:45 +00:00
};
"turn.lukegb.com" = {
2021-04-02 00:52:45 +00:00
group = "turnserver";
hostnames = [ "turn.lukegb.com" ];
reloadOrRestartUnits = [ "coturn.service" ];
2021-04-02 00:52:45 +00:00
};
2021-03-28 22:46:55 +00:00
};
system.stateVersion = "21.05";
}