lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

bvm-prosody: configure prosody

Browse source
This commit is contained in:
Luke Granger-Brown 2021-04-02 00:52:45 +00:00
parent fbc3b47854
commit fe3f343ef9
1 changed files with 66 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

67
ops/nixos/bvm-prosody/default.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: Apache-2.0
{ depot, ... }:
{ config, depot, pkgs, ... }:
let
inherit (depot.ops) secrets;
machineSecrets = secrets.machineSpecific.bvm-prosody;
@ -25,6 +25,9 @@ in {
};
defaultGateway = { address = "92.118.28.1"; interface = "enp6s0"; };
defaultGateway6 = { address = "2a09:a441::1"; interface = "enp6s0"; };
firewall.allowedUDPPorts = [ 3478 ];
firewall.allowedTCPPorts = [ 80 443 3478 5280 5281 5222 5223 5269 5298 ];
};
my.ip.tailscale = "100.86.22.44";
@ -33,6 +36,68 @@ in {
use-auth-secret = true;
realm = "turn.lukegb.com";
static-auth-secret = machineSecrets.turnSecret;
cert = "${config.security.acme.certs."turn.lukegb.com".directory}/fullchain.pem";
pkey = "${config.security.acme.certs."turn.lukegb.com".directory}/key.pem";
};
services.prosody = {
enable = true;
admins = [ "admin@lukegb.com" "lukegb@lukegb.com" ];
package = pkgs.prosody.override {
withCommunityModules = [ "external_services" ];
};
virtualHosts."lukegb.com" = {
enabled = true;
domain = "lukegb.com";
ssl.cert = "${config.security.acme.certs."xmpp.lukegb.com".directory}/fullchain.pem";
ssl.key = "${config.security.acme.certs."xmpp.lukegb.com".directory}/key.pem";
};
muc = [{
domain = "muc.xmpp.lukegb.com";
}];
uploadHttp.domain = "upload.xmpp.lukegb.com";
extraConfig = ''
proxy65_address = "xmpp.lukegb.com"
proxy65_acl = { "lukegb.com" }
component_ports = { 5347 }
component_interface = { "127.0.0.1", "::1" }
legacy_ssl_ports = { 5223 }
external_services = {
{
type = "stun",
transport = "udp",
host = "turn.lukegb.com",
port = 3478,
}, {
type = "turn",
transport = "udp",
host = "turn.lukegb.com",
port = 3478,
secret = "${machineSecrets.turnSecret}",
}
}
'';
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."xmpp.lukegb.com" = {
group = "prosody";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [ "*.xmpp.lukegb.com" "lukegb.com" ];
};
certs."turn.lukegb.com" = {
group = "turnserver";
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
};
};
system.stateVersion = "21.05";