element call done

clients/quadraticserver/element-call.nix

@@ -3,11 +3,13 @@
   config,
   ...
 }: {
-  services = {
+  services = let
+    domain = "call.henryhiles.com";
+  in {
     lk-jwt-service = {
       enable = true;
       livekit = {
-        url = "wss://call.henryhiles.com/livekit/sfu";
+        url = "wss://${domain}/livekit/sfu";
         keyFile = config.age.secrets."livekitKeys.age".path;
       };
     };
@@ -17,7 +19,7 @@
       keyFile = config.age.secrets."livekitKeys.age".path;
     };
 
-    caddy.virtualHosts."call.henryhiles.com".extraConfig = ''
+    caddy.virtualHosts."${domain}".extraConfig = ''
       root * ${pkgs.element-call}
       route {
       	respond /config.json `${builtins.toJSON {
@@ -27,7 +29,7 @@
             "server_name" = "henryhiles.com";
           };
         };
-        livekit.livekit_service_url = "https://call.henryhiles.com/livekit";
+        livekit.livekit_service_url = "https://${domain}/livekit";
       }}` 200
 
       	handle /livekit/sfu/get {

clients/quadraticserver/vaultwarden.nix

@@ -1,6 +1,6 @@
 {
   services = let
-    domain = "vaultwarden.henryhiles.com";
+    domain = "vault.henryhiles.com";
   in {
     vaultwarden = {
       enable = true;

modules/common/services/livekit.nix

@@ -6,14 +6,17 @@
 }: let
   cfg = config.services.livekit;
 in {
-  meta.maintainers = [lib.maintainers.quadradical];
+  meta.maintainers = with lib.maintainers; [quadradical];
   options.services.livekit = {
-    enable = lib.mkEnableOption "Livekit SFU";
+    enable = lib.mkEnableOption "Enable the livekit server";
     package = lib.mkPackageOption pkgs "livekit" {};
 
     keyFile = lib.mkOption {
       type = lib.types.path;
-      description = "LiveKit key file, with syntax `LIVEKIT_KEYS=\"key: secret\"`;";
+      description = ''
+        LiveKit key file, with syntax `LIVEKIT_KEYS=\"key: secret\"`
+        The key and secret are used by other clients or services to connect to your Livekit instance.
+      '';
     };
 
     openFirewall = lib.mkOption {
@@ -75,7 +78,6 @@ in {
       serviceConfig = {
         EnvironmentFile = cfg.keyFile;
         DynamicUser = true;
-        User = "livekit";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         ProtectClock = true;
@@ -101,18 +103,18 @@ in {
           "~@privileged"
           "~@resources"
         ];
-        CapabilityBoundingSet = [
+        ExecStart = "${lib.getExe cfg.package} --config-body=${
-          "CAP_NET_BIND_SERVICE"
+          builtins.toJSON (
-          "CAP_NET_RAW"
+            builtins.toJSON {
-        ];
+              port = cfg.port;
-        ExecStart = "${cfg.package}/bin/livekit-server --config-body=${builtins.toJSON (builtins.toJSON {
+              rtc = {
-          port = cfg.port;
+                port_range_start = cfg.rtc.portRangeStart;
-          rtc = {
+                port_range_end = cfg.rtc.portRangeEnd;
-            port_range_start = cfg.rtc.portRangeStart;
+                use_external_ip = cfg.useExternalIP;
-            port_range_end = cfg.rtc.portRangeEnd;
+              };
-            use_external_ip = cfg.useExternalIP;
+            }
-          };
+          )
-        })}";
+        }";
         Restart = "on-failure";
         RestartSec = 5;
         UMask = "077";

modules/common/services/lk-jwt-service.nix

@@ -14,14 +14,17 @@ in {
     livekit = {
       url = lib.mkOption {
         type = lib.types.str;
-        description = "The URL that livekit runs on, prefixed with `ws://` or `wss://` (recommended).";
+        description = ''
+          The URL that livekit runs on, prefixed with `ws://` or `wss://` (recommended).
+          For example, `wss://example.com/livekit/sfu`
+        '';
       };
 
       keyFile = lib.mkOption {
         type = lib.types.path;
         description = ''
           Path to a file showing LiveKit keys, where you must declare some of: `LIVEKIT_KEY`, `LIVEKIT_SECRET`, `LIVEKIT_KEY_FROM_FILE`, `LIVEKIT_SECRET_FROM_FILE`, and/or `LIVEKIT_KEY_FILE`.
-          For more information see <https://github.com/element-hq/lk-jwt-service>.
+          For more information, see <https://github.com/element-hq/lk-jwt-service#configuration>.
         '';
       };
     };
@@ -29,7 +32,7 @@ in {
     port = lib.mkOption {
       type = lib.types.port;
       default = 8080;
-      description = "Port that lk-jwt-service should run on";
+      description = "Port that lk-jwt-service should listen on.";
     };
   };
 
@@ -45,7 +48,6 @@ in {
       serviceConfig = {
         EnvironmentFile = cfg.livekit.keyFile;
         DynamicUser = true;
-        User = "lk-jwt-service";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
         ProtectClock = true;
@@ -70,11 +72,7 @@ in {
           "~@privileged"
           "~@resources"
         ];
-        CapabilityBoundingSet = [
+        ExecStart = lib.getExe cfg.package;
-          "CAP_NET_BIND_SERVICE"
-          "CAP_NET_RAW"
-        ];
-        ExecStart = "${cfg.package}/bin/lk-jwt-service";
         Restart = "on-failure";
         RestartSec = 5;
         UMask = "077";

secrets/livekitKeys.age

@@ -1,11 +1,12 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZLUVVkUSB0QU8r
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFZLUVVkUSBEb3hG
-VGtZaWU4cjBOaG8ya2ZoalFrb053MjQxS2ttajgwRDdVay8vVDM0CnpaenVhNVJh
+alZjckJtLzFxTGtzZkRwSlMwUWxjbEUrY0RhTUVKTzhNMGJ6LzEwCjZGY01MV3Vz
-dEU0V3RuQmxLTEV0RzBWWGFlOXJJaEROblRoV2RpMHlTZDgKLT4gUVBTLWdyZWFz
+SXVkTGJadHlHRnBjL0xBWTU4SElrQjBibnBvQ0pqeE50VkUKLT4gc2JVLWdyZWFz
-ZSBMN2piZn4rIGZ1ZWZaIGwKa1VQYVZWTjRHeWZwWHBQamEwdlFhb2NBOGswdDAr
+ZSBqd3wgOi0gYCxkIFpkbURYClZkRGw3NHhYanBJbEZGUzloMDdkQ1BsWnlNNC82
-WjRHRWszcHZ6TEpNdFJVRnRMa3dBCi0tLSB3SW53ZnZadHcySDZ6Szh5aGJ4eTlp
+blVPUkZxV0pFZ0tleERtekVSUEt6YXRvUjhqQ2VLMGVUODMKVXdSdDNGSTNRb1NL
-SklsTEN0dytUTTVDTTczbHFjRUtVCngKorWJWsl4T5Ko0IEh52VOUMPvvFXCFea1
+clEzV1JpZnFXMGtrVVhPQllTWQotLS0gMDFDV0xGY0tSTWgxWklaZit1bFlkRmkr
-MsE2dWUwfYug3r6s/C+xVRbqTfyYj5+sZNRJGGaCxkL7E0f6tahCOOuBymJHAgiK
+SWd1TmRzbGlzK0Fsc3JPa21Sdwq1tIFHOqPsd1rNPpJRWvxOXE1EJ09PBqXiZ5a5
-lyxnNSFBTman1WZQSYwiBwxPBVLBD28iVzmoPqwPhX50gMXMFfQtSJOsjnQ5xp52
+k8S4NuHaRj/7LI82GRT3ELRdWcU06KFKaKie63vX73WGcXgT0kJocRG1khy/cyuP
-eperXjPRidTlQlApidQ5jCKMuXQJ/O0nuUHO7Gxob8QMSWMFbIyXSL0=
+Sfk/1H0eo9GVixwPwQhlOCVGUPJqcPMtM4/cQ1oA3A0VX3g3AkznFhoD2zR7OBH0
+RWhsh4iDFT4a4bIMlPe5JBRMdTwRTCjRHVOm
 -----END AGE ENCRYPTED FILE-----

secrets/mailPassword.age

@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 VKQUdQ HLH8VPiSrQCLCA6jDDNgRwGxmBYx/tp29Ofk+lASR20
-61DZpjUfqtSWg76RqZ4dQZMkLh3Z9/AXIshdnAZL2Os
---- NtZ+33l6WGz+UMzSLxqLVATi2fdk60CDdWm9X71sqm4
-À§X±É*è²=}źìd%­ªÅgCÀ”¬Ÿîs2eœN3dYž¥åÐŽW7C¦~ltI<74>D_Köðp[ªªyÓÿÁ§Ðé|6‚É€m˜`F±tŸR0<52>¶ð