Henry-Hiles/nixos
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

RM local modules

Browse source
This commit is contained in:
Henry Hiles 2025-05-04 20:48:40 -04:00
parent 476016706d
commit 2b93b04dbe
Signed by: Henry-Hiles
SSH key fingerprint: SHA256:VKQUdS31Q90KvX7EkKMHMBpUspcmItAh86a+v7PGiIs
4 changed files with 43 additions and 260 deletions
Download patch file Download diff file Expand all files Collapse all files

133
modules/common/services/livekit.nix
View file

@ -1,133 +0,0 @@
{
config,
lib,
pkgs,
utils,
...
}: let
cfg = config.services.livekit;
format = pkgs.formats.json {};
in {
meta.maintainers = with lib.maintainers; [quadradical];
options.services.livekit = {
enable = lib.mkEnableOption "Enable the livekit server";
package = lib.mkPackageOption pkgs "livekit" {};
keyFile = lib.mkOption {
type = lib.types.path;
description = ''
LiveKit key file, with syntax `APIkey: secret`.
The key and secret are used by other clients or services to connect to your Livekit instance.
'';
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Opens port range for LiveKit on the firewall.";
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = format.type;
options = {
port = lib.mkOption {
type = lib.types.port;
default = 7880;
description = "Main TCP port for RoomService and RTC endpoint.";
};
rtc = {
port_range_start = lib.mkOption {
type = lib.types.int;
default = 50000;
description = "Start of UDP port range for WebRTC";
};
port_range_end = lib.mkOption {
type = lib.types.int;
default = 51000;
description = "End of UDP port range for WebRTC";
};
use_external_ip = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
When set to true, attempts to discover the host's public IP via STUN.
This is useful for cloud environments such as AWS & Google where hosts have an internal IP that maps to an external one
'';
};
};
};
};
default = {};
description = ''
LiveKit configuration file expressed in nix.
For an example configuration, see <https://docs.livekit.io/home/self-hosting/deployment/#configuration>.
For all possible values, see <https://github.com/livekit/livekit/blob/master/config-sample.yaml>.
'';
};
};
config = lib.mkIf cfg.enable {
networking.firewall = lib.mkIf cfg.openFirewall {
allowedTCPPorts = [
cfg.settings.port
];
allowedUDPPortRanges = [
{
from = cfg.settings.rtc.port_range_start;
to = cfg.settings.rtc.port_range_end;
}
];
};
systemd.services.livekit = {
description = "LiveKit SFU server";
documentation = ["https://docs.livekit.io"];
wantedBy = ["multi-user.target"];
wants = ["network-online.target"];
after = ["network-online.target"];
serviceConfig = {
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateUsers = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
"AF_NETLINK"
];
RestrictNamespaces = true;
RestrictRealtime = true;
ProtectHome = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
LoadCredential = ["livekit-secrets:${cfg.keyFile}"];
ExecStart = utils.escapeSystemdExecArgs [
(lib.getExe cfg.package)
"--config=${format.generate "livekit.json" cfg.settings}"
"--key-file=/run/credentials/livekit.service/livekit-secrets"
];
Restart = "on-failure";
RestartSec = 5;
UMask = "077";
};
};
};
}

85
modules/common/services/lk-jwt-service.nix
View file

@ -1,85 +0,0 @@
{
config,
lib,
pkgs,
...
}: let
cfg = config.services.lk-jwt-service;
in {
meta.maintainers = [lib.maintainers.quadradical];
options.services.lk-jwt-service = {
enable = lib.mkEnableOption "Enable lk-jwt-service";
package = lib.mkPackageOption pkgs "lk-jwt-service" {};
livekitUrl = lib.mkOption {
type = lib.types.strMatching "^wss?://.*";
example = "wss://example.com/livekit/sfu";
description = ''
The public websocket URL for livekit.
The proto needs to be either `wss://` (recommended) or `ws://` (insecure).
'';
};
keyFile = lib.mkOption {
type = lib.types.path;
description = ''
Path to your LiveKit key file, with syntax `APIkey: secret`.
For more information, see <https://github.com/element-hq/lk-jwt-service#configuration>.
'';
};
port = lib.mkOption {
type = lib.types.port;
default = 8080;
description = "Port that lk-jwt-service should listen on.";
};
};
config = lib.mkIf cfg.enable {
systemd.services.lk-jwt-service = {
description = "Minimal service to issue LiveKit JWTs for MatrixRTC";
documentation = ["https://github.com/element-hq/lk-jwt-service"];
wantedBy = ["multi-user.target"];
wants = ["network-online.target"];
after = ["network-online.target"];
environment = {
LIVEKIT_URL = cfg.livekitUrl;
LIVEKIT_JWT_PORT = toString cfg.port;
LIVEKIT_KEY_FILE = "/run/credentials/lk-jwt-service.service/livekit-secrets";
};
serviceConfig = {
DynamicUser = true;
LockPersonality = true;
MemoryDenyWriteExecute = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateUsers = true;
RestrictAddressFamilies = [
"AF_INET"
"AF_INET6"
];
RestrictNamespaces = true;
RestrictRealtime = true;
ProtectHome = true;
SystemCallArchitectures = "native";
SystemCallFilter = [
"@system-service"
"~@privileged"
"~@resources"
];
LoadCredential = ["livekit-secrets:${cfg.keyFile}"];
ExecStart = lib.getExe cfg.package;
Restart = "on-failure";
RestartSec = 5;
UMask = "077";
};
};
};
}

1
modules/desktop/firefox/default.nix
View file

@ -131,6 +131,7 @@
"jid1-MnnxcxisBPnSXQ@jetpack" # Privacy Badger
"frankerfacez@frankerfacez.com"
"7esoorv3@alefvanoon.anonaddy.me" # LibRedirect
"{cf3dba12-a848-4f68-8e2d-f9fadc0721de}" # Google Lighthouse
"{446900e4-71c2-419f-a6a7-df9c091e268b}" # Bitwarden
"{4ce83447-8255-43c2-b8f7-e02eb8c2cc39}" # Draw on Page
"{ac34afe8-3a2e-4201-b745-346c0cf6ec7d}" # Better Youtube Shorts