From c160964c1850fc48453c9bc8ded59b956e3fcb2c Mon Sep 17 00:00:00 2001 From: Henry-Hiles Date: Fri, 18 Apr 2025 00:53:02 -0400 Subject: [PATCH] element call done --- clients/quadraticserver/element-call.nix | 10 ++++--- clients/quadraticserver/vaultwarden.nix | 2 +- modules/common/services/livekit.nix | 34 ++++++++++++---------- modules/common/services/lk-jwt-service.nix | 16 +++++----- secrets/livekitKeys.age | 19 ++++++------ secrets/mailPassword.age | 5 ---- 6 files changed, 42 insertions(+), 44 deletions(-) delete mode 100644 secrets/mailPassword.age diff --git a/clients/quadraticserver/element-call.nix b/clients/quadraticserver/element-call.nix index 966d0a7..53f2fa4 100644 --- a/clients/quadraticserver/element-call.nix +++ b/clients/quadraticserver/element-call.nix @@ -3,11 +3,13 @@ config, ... }: { - services = { + services = let + domain = "call.henryhiles.com"; + in { lk-jwt-service = { enable = true; livekit = { - url = "wss://call.henryhiles.com/livekit/sfu"; + url = "wss://${domain}/livekit/sfu"; keyFile = config.age.secrets."livekitKeys.age".path; }; }; @@ -17,7 +19,7 @@ keyFile = config.age.secrets."livekitKeys.age".path; }; - caddy.virtualHosts."call.henryhiles.com".extraConfig = '' + caddy.virtualHosts."${domain}".extraConfig = '' root * ${pkgs.element-call} route { respond /config.json `${builtins.toJSON { @@ -27,7 +29,7 @@ "server_name" = "henryhiles.com"; }; }; - livekit.livekit_service_url = "https://call.henryhiles.com/livekit"; + livekit.livekit_service_url = "https://${domain}/livekit"; }}` 200 handle /livekit/sfu/get { diff --git a/clients/quadraticserver/vaultwarden.nix b/clients/quadraticserver/vaultwarden.nix index d9c8938..0ffdbfb 100644 --- a/clients/quadraticserver/vaultwarden.nix +++ b/clients/quadraticserver/vaultwarden.nix @@ -1,6 +1,6 @@ { services = let - domain = "vaultwarden.henryhiles.com"; + domain = "vault.henryhiles.com"; in { vaultwarden = { enable = true; diff --git a/modules/common/services/livekit.nix b/modules/common/services/livekit.nix index 57a88be..bd06cfa 100644 --- a/modules/common/services/livekit.nix +++ b/modules/common/services/livekit.nix @@ -6,14 +6,17 @@ }: let cfg = config.services.livekit; in { - meta.maintainers = [lib.maintainers.quadradical]; + meta.maintainers = with lib.maintainers; [quadradical]; options.services.livekit = { - enable = lib.mkEnableOption "Livekit SFU"; + enable = lib.mkEnableOption "Enable the livekit server"; package = lib.mkPackageOption pkgs "livekit" {}; keyFile = lib.mkOption { type = lib.types.path; - description = "LiveKit key file, with syntax `LIVEKIT_KEYS=\"key: secret\"`;"; + description = '' + LiveKit key file, with syntax `LIVEKIT_KEYS=\"key: secret\"` + The key and secret are used by other clients or services to connect to your Livekit instance. + ''; }; openFirewall = lib.mkOption { @@ -75,7 +78,6 @@ in { serviceConfig = { EnvironmentFile = cfg.keyFile; DynamicUser = true; - User = "livekit"; LockPersonality = true; MemoryDenyWriteExecute = true; ProtectClock = true; @@ -101,18 +103,18 @@ in { "~@privileged" "~@resources" ]; - CapabilityBoundingSet = [ - "CAP_NET_BIND_SERVICE" - "CAP_NET_RAW" - ]; - ExecStart = "${cfg.package}/bin/livekit-server --config-body=${builtins.toJSON (builtins.toJSON { - port = cfg.port; - rtc = { - port_range_start = cfg.rtc.portRangeStart; - port_range_end = cfg.rtc.portRangeEnd; - use_external_ip = cfg.useExternalIP; - }; - })}"; + ExecStart = "${lib.getExe cfg.package} --config-body=${ + builtins.toJSON ( + builtins.toJSON { + port = cfg.port; + rtc = { + port_range_start = cfg.rtc.portRangeStart; + port_range_end = cfg.rtc.portRangeEnd; + use_external_ip = cfg.useExternalIP; + }; + } + ) + }"; Restart = "on-failure"; RestartSec = 5; UMask = "077"; diff --git a/modules/common/services/lk-jwt-service.nix b/modules/common/services/lk-jwt-service.nix index 90e17a5..a91a6bf 100644 --- a/modules/common/services/lk-jwt-service.nix +++ b/modules/common/services/lk-jwt-service.nix @@ -14,14 +14,17 @@ in { livekit = { url = lib.mkOption { type = lib.types.str; - description = "The URL that livekit runs on, prefixed with `ws://` or `wss://` (recommended)."; + description = '' + The URL that livekit runs on, prefixed with `ws://` or `wss://` (recommended). + For example, `wss://example.com/livekit/sfu` + ''; }; keyFile = lib.mkOption { type = lib.types.path; description = '' Path to a file showing LiveKit keys, where you must declare some of: `LIVEKIT_KEY`, `LIVEKIT_SECRET`, `LIVEKIT_KEY_FROM_FILE`, `LIVEKIT_SECRET_FROM_FILE`, and/or `LIVEKIT_KEY_FILE`. - For more information see . + For more information, see . ''; }; }; @@ -29,7 +32,7 @@ in { port = lib.mkOption { type = lib.types.port; default = 8080; - description = "Port that lk-jwt-service should run on"; + description = "Port that lk-jwt-service should listen on."; }; }; @@ -45,7 +48,6 @@ in { serviceConfig = { EnvironmentFile = cfg.livekit.keyFile; DynamicUser = true; - User = "lk-jwt-service"; LockPersonality = true; MemoryDenyWriteExecute = true; ProtectClock = true; @@ -70,11 +72,7 @@ in { "~@privileged" "~@resources" ]; - CapabilityBoundingSet = [ - "CAP_NET_BIND_SERVICE" - "CAP_NET_RAW" - ]; - ExecStart = "${cfg.package}/bin/lk-jwt-service"; + ExecStart = lib.getExe cfg.package; Restart = "on-failure"; RestartSec = 5; UMask = "077"; diff --git a/secrets/livekitKeys.age b/secrets/livekitKeys.age index 7fb830f..26874dc 100644 --- a/secrets/livekitKeys.age +++ b/secrets/livekitKeys.age @@ -1,11 +1,12 @@ -----BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZLUVVkUSB0QU8r -VGtZaWU4cjBOaG8ya2ZoalFrb053MjQxS2ttajgwRDdVay8vVDM0CnpaenVhNVJh -dEU0V3RuQmxLTEV0RzBWWGFlOXJJaEROblRoV2RpMHlTZDgKLT4gUVBTLWdyZWFz -ZSBMN2piZn4rIGZ1ZWZaIGwKa1VQYVZWTjRHeWZwWHBQamEwdlFhb2NBOGswdDAr -WjRHRWszcHZ6TEpNdFJVRnRMa3dBCi0tLSB3SW53ZnZadHcySDZ6Szh5aGJ4eTlp -SklsTEN0dytUTTVDTTczbHFjRUtVCngKorWJWsl4T5Ko0IEh52VOUMPvvFXCFea1 -MsE2dWUwfYug3r6s/C+xVRbqTfyYj5+sZNRJGGaCxkL7E0f6tahCOOuBymJHAgiK -lyxnNSFBTman1WZQSYwiBwxPBVLBD28iVzmoPqwPhX50gMXMFfQtSJOsjnQ5xp52 -eperXjPRidTlQlApidQ5jCKMuXQJ/O0nuUHO7Gxob8QMSWMFbIyXSL0= +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZLUVVkUSBEb3hG +alZjckJtLzFxTGtzZkRwSlMwUWxjbEUrY0RhTUVKTzhNMGJ6LzEwCjZGY01MV3Vz +SXVkTGJadHlHRnBjL0xBWTU4SElrQjBibnBvQ0pqeE50VkUKLT4gc2JVLWdyZWFz +ZSBqd3wgOi0gYCxkIFpkbURYClZkRGw3NHhYanBJbEZGUzloMDdkQ1BsWnlNNC82 +blVPUkZxV0pFZ0tleERtekVSUEt6YXRvUjhqQ2VLMGVUODMKVXdSdDNGSTNRb1NL +clEzV1JpZnFXMGtrVVhPQllTWQotLS0gMDFDV0xGY0tSTWgxWklaZit1bFlkRmkr +SWd1TmRzbGlzK0Fsc3JPa21Sdwq1tIFHOqPsd1rNPpJRWvxOXE1EJ09PBqXiZ5a5 +k8S4NuHaRj/7LI82GRT3ELRdWcU06KFKaKie63vX73WGcXgT0kJocRG1khy/cyuP +Sfk/1H0eo9GVixwPwQhlOCVGUPJqcPMtM4/cQ1oA3A0VX3g3AkznFhoD2zR7OBH0 +RWhsh4iDFT4a4bIMlPe5JBRMdTwRTCjRHVOm -----END AGE ENCRYPTED FILE----- diff --git a/secrets/mailPassword.age b/secrets/mailPassword.age deleted file mode 100644 index e517506..0000000 --- a/secrets/mailPassword.age +++ /dev/null @@ -1,5 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 VKQUdQ HLH8VPiSrQCLCA6jDDNgRwGxmBYx/tp29Ofk+lASR20 -61DZpjUfqtSWg76RqZ4dQZMkLh3Z9/AXIshdnAZL2Os ---- NtZ+33l6WGz+UMzSLxqLVATi2fdk60CDdWm9X71sqm4 -X*=}ź d%gCs2eN3dYЎW7C~ltID_Kp[y|6ɀm`FtR0 \ No newline at end of file