haccfiles/hosts/hainich/services/workadventure.nix
stuebinm 9e7a277b6a workadventure: fix turn ipv4 address
apparently I missed changing that; it still pointed to my own
server (flora.stuebinm.eu) instead of hainich.
2021-04-29 22:20:10 +00:00

102 lines
2.8 KiB
Nix

{pkgs, lib, config, ...}:
let
sources = import ../../../nix/sources.nix {};
# why the double outPath? Dunno, just niv things …
workadventure-nix = sources.workadventure.outPath.outPath;
haccmap = sources.haccmap.outPath.outPath;
in
{
# not the most intuitive of container names, but "workadventure" is too long
containers.wa-void = {
# we'll need the outer config to get the turn secret inside the container,
# and I'm feeling haskelly so config' it is!
config = let config' = config; in {config, pkgs, ...}: {
imports = [ workadventure-nix ];
networking.firewall.allowedTCPPorts = [ 80 ];
services.workadventure."void.hacc.space" = {
packageset = (
import "${workadventure-nix}/wapkgs.nix" {
inherit pkgs lib;
}
).workadventure-xce;
nginx = {
default = true;
domain = "void.hacc.space";
maps = {
serve = true;
path = "${haccmap}/";
};
};
frontend.startRoomUrl = "/_/global/void.hacc.space/maps/main.json";
commonConfig = {
webrtc.stun.url = "stun:turn.hacc.space:3478";
webrtc.turn = {
url = "turn:46.4.63.148";
user = "turn";
password = config'.services.coturn.static-auth-secret;
};
jitsi.url = "meet.ffmuc.net";
};
};
};
privateNetwork = true;
hostAddress6 = "fd00::42:14";
localAddress6 = "fd00::42:16";
autoStart = true;
};
services.coturn = {
enable = true;
realm = "turn.hacc.space";
# this is a static "secret" that is also compiled into workadventure,
# so it seems ok to put it into the nix store
static-auth-secret = "990bc6fc68c720a9159f9c7613b2dcc3cc9ffb4f";
use-auth-secret = true;
no-cli = true;
no-tcp-relay = true;
cert = config.security.acme.certs."turn.hacc.space".directory + "full.pem";
pkey = config.security.acme.certs."turn.hacc.space".directory + "key.pem";
};
services.nginx = {
virtualHosts."void.hacc.space" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://[${config.containers.wa-void.localAddress6}]";
proxyWebsockets = true;
};
};
# this isn't actually needed, but acme requires a webserver to serve
# challanges, so I guess it's easier to just define a virtualHost here
virtualHosts."turn.hacc.space" = {
enableACME = true;
forceSSL = true;
};
};
networking.firewall = with config.services.coturn;
let
ports = [ listening-port tls-listening-port ];
in {
allowedTCPPorts = [ 80 ] ++ ports;
allowedUDPPorts = ports;
allowedUDPPortRanges = [
{ from = min-port; to = max-port; }
];
};
}