Lillian-Violet/NixOS-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

see if we can set up livekit on the matrix server

Browse source
This commit is contained in:
Lillian Violet 2026-03-17 16:49:30 +01:00
parent fc02e973fb
commit 842ec53f64
5 changed files with 102 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
nixos/hosts/queen/secrets/sops.yaml
View file

@ -16,6 +16,7 @@ writefreely: ENC[AES256_GCM,data:QOj5h/rHCxmgpPNhu3IS4eyruhQokHTJxW6yQM9YDgQ=,iv
writefreelymysql: ENC[AES256_GCM,data:1JZwIX04O3DBAo7JvEkeNrFcSdcmk/u4WUf/kkbr2JA=,iv:8H8MR8w1iLfl2r62EbxPnLzs4qWFmwB5gNKEaly8q6c=,tag:K01oKMXkeMOFs3u7frMs0Q==,type:str]
ssh-private-key: ENC[AES256_GCM,data:DK/ggskAyhvotRkf36oZBoPw3hGvVlXneqaJZRPwX2a3YVMy4zgDE3iN65UeR6mfkp9J3OmLejOHeWFB/bRCHY3oTW6GUuZljTe2rI1/x/d2s4zX5UPPEWcy3cXH25d72DzElQBEMDKuZyDe0OZ0/NkR//vEeXgoA2Nr/NKHlTWrq/t26DMD2Vt+kQ+S9b0hh4tgh3OP1lwRu9/mTJOmInd/86gKB9+aD9V0oFvNbMEmgbwIah+ZjQBHB7GEIwjUc/lLmc+3RSn9J0rICIhnhL7NTzHUDHkYd93Tm0L9UHIyi9Oco2sK8tuV5mTDM1OK8CbDg/5FICTQ0H4sstCrDNZd2wE4E1kaZuwYOyxpzQpWJY8jOxxw5oIE0IccvvptM/9vp+0f1F2RIDrkIdHSLpFbGZGvXNVAWlXyv+0qOYS7BGzD0KAh9f74GcAvULq36vdzBahb5e+CqT3JXESne8qhkpsP0G9Z1I1Fy0xpADx/9cTnAm5RmXTw/KBPmBA5IZYZBRbR/C+N7Xyxr7u9RcwFJdIbSpAeT/ew,iv:pHT7DtX1ab7boPboXRaSg9w/4sMgNraEswtEf2tBPkw=,tag:Fbw2/Evf4ZsLFMBPflf9CA==,type:str]
mollysocket-vapid-key: ENC[AES256_GCM,data:8N2hxY6WN6mCcjMIFsw/Vt1RoGvUbYxkVPOOn4WRjXZtEEkkVCIaNevozF4xCnBUEWIukNg8lZk8ake/pHAq,iv:+NHm3hSotcRPRjrwEe9xKnEeYbnUZqJEB1sd5B+tWIE=,tag:Pd2pnJqj771XqdqBREGzJQ==,type:str]
livekit-secret: ENC[AES256_GCM,data:fsYuxQ00Ikp18NyyxZoOGqBrz+vBbEVoYfWUKN57jRveYDpPIV53VoYypQCp54oKsn3AN6A4cMZFQCJqOEsvhnniB+K3,iv:pvXqP8OTKFVUhebUWq2m8tBqvvI2FrXe+mDQYiq/gvQ=,tag:bLA1s922qEMVju5LxlGzJA==,type:str]
sops:
age:
- recipient: age12e00qvf4shtmsfq3ujamyaa72pjvad2qhrxkvpl9hryrjvgxev4sjhmkxz
@ -27,7 +28,7 @@ sops:
KzNBMCtUaS9sU21Xc1JUd1FSR29tSkEKyqaDM/WUWjK2l+ahE6sIFYsQ6Qtkf7yz
NWFTzsDZBmm9kpSIjchf+PuBuoRHeEKbEH8jnMlYB3J8boEnUnXMlw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-08-04T13:04:56Z"
mac: ENC[AES256_GCM,data:ppQgyWY/4Kr8/Ag5x7wBv1RZAxky6Itf4sBBRIzJj8njzSDOPm0blcDHjIGesu9PwmjnnJihZivmWXj43pAjxf6p4FmtlBAIqLUjRIV7fR16VINo7dPx4Pv6+sw1uwFvLliD/FfKwYo2S+Lx0eQnOzW1p7RROpbQJQ8k7AUngKE=,iv:Pk8sPdAMzITgeeaoZHJc77ywp47DuB5A1Lx5pjtHXM0=,tag:JkMDnjYMPTFkyOiikA7ejA==,type:str]
lastmodified: "2026-03-17T15:28:18Z"
mac: ENC[AES256_GCM,data:/ziw/6iAMzPjtwP19IEZuEumQ6qQxE0pr6qhtRxccAzqsQjcZnsHVjrz5wCVlt1TVBsbFnveAY+MbO7pj2Vah0rka5DNs1mV+xfo+POuArboFOsyOOtw1wNXSlRhW/jMhjq7/MMBmPgMlWoals1r7X+wZzGHvBMKMOECfd4B4dY=,iv:KQUC8AfEn0TQxKZ9+PrD/bSaOz0HjifvluDQFwXcGIk=,tag:n788ZvgcnvU63ue3TOYWAw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2
version: 3.12.1

88
nixos/server/package-configs/conduit/default.nix
View file

@ -19,6 +19,11 @@
}
'';
livekit-port = 64485;
livekit-rtc-start = 63400;
livekit-rtc-end = 63600;
livekit-url = "livekit.gladtherescake.eu";
# Build a dervation that stores the content of `${server_name}/.well-known/matrix/client`
well_known_client = pkgs.writeText "well-known-matrix-client" ''
{
@ -28,6 +33,27 @@
}
'';
in {
sops.secrets = {
"livekit-secret" = {
mode = "0440";
owner = "nginx";
};
};
services.livekit = {
enable = true;
keyFile = config.sops.secrets."livekit-secret".path;
openFirewall = true;
redis.port = 64484;
settings = {
port = livekit-port;
rtc = {
port_range_start = livekit-rtc-start;
port_range_end = livekit-rtc-end;
use_external_ip = true;
};
};
};
# Configure continuwuity itself
services.matrix-continuwuity = {
enable = true;
@ -37,7 +63,12 @@ in {
allow_registration = false;
# emergency_password = "testpassword";
turn_uris = ["turn:turn.gladtherescake.eu.url?transport=udp" "turn:turn.gladtherescake.eu?transport=tcp"];
turn_secret = "cPKWEn4Fo5TAJoE7iX3xeVOaMVE4afeRN1iRGWYfbkWbkaZMxTpnmazHyH6c6yXT";
matrix_rtc = {
foci = [
''{type = "livekit", livekit_service_url = "https://${livekit-url}"},''
];
};
turn-secret-file = config.sops.secrets."coturn-auth-secret".path;
well_known = {
server = "matrix.gladtherescake.eu:443";
client = "https://matrix.gladtherescake.eu";
@ -63,7 +94,7 @@ in {
enable = true;
virtualHosts = {
"${server_name}" = {
"${livekit-url}" = {
forceSSL = true;
enableACME = true;
@ -90,6 +121,59 @@ in {
}
];
locations."~ ^/(sfu/get|healthz|get_token)" = {
proxyPass = "http://127.0.0.1:${toString livekit-port}$request_uri";
extraConfig = ''
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_buffering off;
'';
};
# for livekit
locations."/" = {
proxyPass = "http://127.0.0.1:${toString livekit-port}$request_uri;";
extraConfig = ''
X-Forwarded-For $remote_addr;"
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Host $http_host;
proxy_buffering off;
# websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
'';
};
};
"${server_name}" = {
forceSSL = true;
enableACME = true;
listen = [
{
addr = "0.0.0.0";
port = 443;
ssl = true;
}
{
addr = "[::]";
port = 443;
ssl = true;
}
{
addr = "0.0.0.0";
port = livekit-port;
ssl = true;
}
{
addr = "[::]";
port = livekit-port;
ssl = true;
}
];
locations."/_matrix/" = {
proxyPass = "http://backend_continuwuity";
proxyWebsockets = true;

14
nixos/server/package-configs/nextcloud/default.nix
View file

@ -3,10 +3,16 @@
pkgs,
...
}: {
sops.secrets."nextcloudadmin".mode = "0440";
sops.secrets."nextcloudadmin".owner = config.users.users.nextcloud.name;
sops.secrets."nextclouddb".mode = "0440";
sops.secrets."nextclouddb".owner = config.users.users.nextcloud.name;
sops.secrets = {
"nextcloudadmin" = {
mode = "0440";
owner = config.users.users.nextcloud.name;
};
"nextclouddb" = {
mode = "0440";
owner = config.users.users.nextcloud.name;
};
};
# sops.secrets."local.json".mode = "0440";
# sops.secrets."local.json".owner = config.users.users.onlyoffice.name;