colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

coturn: expand documentation

Browse Source
This commit is contained in:
Colin
2024-05-16 09:41:53 +00:00
parent 63cbcb0896
commit 5924d092f4
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
hosts/by-name/servo/services/coturn.nix
View File

@@ -29,6 +29,13 @@
# - bind the turn server to the veth connecting it to the VPN namespace (so it sends outgoing traffic to the right place). # - bind the turn server to the veth connecting it to the VPN namespace (so it sends outgoing traffic to the right place).
# - NAT the turn port range from VPN into root namespace (so it receives incomming traffic). # - NAT the turn port range from VPN into root namespace (so it receives incomming traffic).
# - this approach would fail the prosody conversations.im check, but i didn't notice *obvious* call routing errors. # - this approach would fail the prosody conversations.im check, but i didn't notice *obvious* call routing errors.
#
# debugging:
# - log messages like 'usage: realm=<turn.uninsane.org>, username=<1715915193>, rp=14, rb=1516, sp=8, sb=684'
# - rp = received packets
# - rb = received bytes
# - sp = sent packets
# - sb = sent bytes
{ lib, ... }: { lib, ... }:
let let
# TURN port range (inclusive). # TURN port range (inclusive).
@@ -110,16 +117,19 @@ in
services.coturn.realm = "turn.uninsane.org"; services.coturn.realm = "turn.uninsane.org";
services.coturn.cert = "/var/lib/acme/turn.uninsane.org/fullchain.pem"; services.coturn.cert = "/var/lib/acme/turn.uninsane.org/fullchain.pem";
services.coturn.pkey = "/var/lib/acme/turn.uninsane.org/key.pem"; services.coturn.pkey = "/var/lib/acme/turn.uninsane.org/key.pem";
#v disable to allow unauthenticated access (or set `services.coturn.no-auth = true`)
services.coturn.use-auth-secret = true; services.coturn.use-auth-secret = true;
services.coturn.static-auth-secret-file = "/var/lib/coturn/shared_secret.bin"; services.coturn.static-auth-secret-file = "/var/lib/coturn/shared_secret.bin";
services.coturn.lt-cred-mech = true; services.coturn.lt-cred-mech = true; #< XXX: use-auth-secret overrides lt-cred-mech
services.coturn.min-port = turnPortLow; services.coturn.min-port = turnPortLow;
services.coturn.max-port = turnPortHigh; services.coturn.max-port = turnPortHigh;
# services.coturn.secure-stun = true; # services.coturn.secure-stun = true;
services.coturn.extraConfig = lib.concatStringsSep "\n" [ services.coturn.extraConfig = lib.concatStringsSep "\n" [
"verbose" "verbose"
# "Verbose" #< even MORE verbosity than "verbose" # "Verbose" #< even MORE verbosity than "verbose" (it's TOO MUCH verbosity really)
# "no-multicast-peers" # disables sending to IPv4 broadcast addresses (e.g. 224.0.0.0/3) "no-multicast-peers" # disables sending to IPv4 broadcast addresses (e.g. 224.0.0.0/3)
# "listening-ip=10.0.1.5" "external-ip=185.157.162.178" #< 2024/04/25: works, if running in root namespace # "listening-ip=10.0.1.5" "external-ip=185.157.162.178" #< 2024/04/25: works, if running in root namespace
"listening-ip=185.157.162.178" "external-ip=185.157.162.178" "listening-ip=185.157.162.178" "external-ip=185.157.162.178"