feat: extend holochain-turn-server module and add stun-0.main.infra.holo.host instance

modules/flake-parts/holochain-turn-server.nix

@@ -22,6 +22,7 @@
     nixosModules.holochain-turn-server = {
       config,
       lib,
+      options,
       ...
     }: let
       cfg = config.services.holochain-turn-server;
@@ -49,6 +50,12 @@
           default = 82;
         };
 
+        listening-port = lib.mkOption {
+          description = options.services.coturn.listening-port.description;
+          type = lib.types.nullOr lib.types.int;
+          default = 80;
+        };
+
         coturn-min-port = lib.mkOption {
           description = "lower port for coturn's range";
           type = lib.types.int;
@@ -71,38 +78,56 @@
 
         username = lib.mkOption {
           description = "user for establishing turn connections to coturn";
-          type = lib.types.str;
-          default = "test";
+          type = lib.types.nullOr lib.types.str;
+          default = null;
         };
 
         credential = lib.mkOption {
           description = "credential for establishing turn connections to coturn";
-          type = lib.types.str;
-          default = "test";
+          type = lib.types.nullOr lib.types.str;
+          default = null;
         };
 
         extraCoturnAttrs = lib.mkOption {
           description = "extra attributes assigned to services.coturn";
           type = lib.types.attrs;
           default = {};
         };
+
+        extraCoturnConfig = lib.mkOption {
+          description = "extra config passed to coturn";
+          type = lib.types.str;
+          default = "";
+        };
+
+        acme-staging = lib.mkEnableOption "use ACME's staging server which has retry limits. useful when debugging ACME challenges.";
       };
 
       config = lib.mkIf cfg.enable {
         nixpkgs.overlays = [self.overlays.coturn];
 
-        networking.firewall.allowedTCPPorts = [
-          80
-          443
-          9641 # prometheus
-
-          cfg.nginx-http-port
-        ];
-        networking.firewall.allowedUDPPorts = [
-          80
-          443
-          9641 # prometheus
-        ];
+        networking.firewall.allowedTCPPorts =
+          (
+            lib.lists.optionals (cfg.listening-port != null) [
+              cfg.listening-port
+            ]
+          )
+          ++ [
+            443
+            9641 # prometheus
+
+            cfg.nginx-http-port
+          ];
+        networking.firewall.allowedUDPPorts =
+          (
+            lib.lists.optionals (cfg.listening-port != null) [
+              cfg.listening-port
+            ]
+          )
+          ++ [
+            443
+            9641 # prometheus
+          ];
         networking.firewall.allowedUDPPortRanges = [
           {
             from = cfg.coturn-min-port;
@@ -113,10 +138,9 @@
         services.coturn =
           {
             enable = true;
-            listening-port = 80;
             tls-listening-port = 443;
             listening-ips = [cfg.address];
-            lt-cred-mech = true; # Use long-term credential mechanism.
+            lt-cred-mech = cfg.username != null && cfg.credential != null; # Use long-term credential mechanism.
             realm = cfg.url;
             cert = "${cfg.turn-cert-dir}/fullchain.pem";
             pkey = "${cfg.turn-cert-dir}/key.pem";
@@ -129,15 +153,22 @@
                 no-multicast-peers
                 no-tlsv1
                 no-tlsv1_1
-                user=${cfg.username}:${cfg.credential}
                 prometheus
               ''
+              + lib.strings.optionalString config.services.coturn.lt-cred-mech ''
+                user=${cfg.username}:${cfg.credential}
+              ''
               + lib.strings.optionalString cfg.verbose ''
                 verbose
               ''
               + lib.strings.optionalString (cfg.acme-redirect != null) ''
                 acme-redirect=${cfg.acme-redirect}
-              '';
+              ''
+              + cfg.extraCoturnConfig;
+          }
+          // lib.attrsets.optionalAttrs (cfg.listening-port
+            != null) {
+            inherit (cfg) listening-port;
           }
           // cfg.extraCoturnAttrs;
 
@@ -167,19 +198,22 @@
           };
         };
 
-        security.acme = {
-          acceptTerms = true;
-          defaults = {
-            email = "acme@holo.host";
-          };
-
-          # after certificate renewal by acme coturn.service needs to reload this new cert, too
-          # see https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/security/acme/default.nix#L322
-          certs."${cfg.url}".reloadServices = ["coturn"];
-
-          # staging server has higher retry limits. uncomment the following when debugging ACME challenges.
-          # certs."${cfg.url}".server = "https://acme-staging-v02.api.letsencrypt.org/directory";
-        };
+        security.acme =
+          lib.attrsets.recursiveUpdate
+          {
+            acceptTerms = true;
+            defaults = {
+              email = "acme@holo.host";
+            };
+
+            # after certificate renewal by acme coturn.service needs to reload this new cert, too
+            # see https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/security/acme/default.nix#L322
+            certs."${cfg.url}".reloadServices = ["coturn"];
+          } (
+            lib.attrsets.optionalAttrs cfg.acme-staging {
+              certs."${cfg.url}".server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+            }
+          );
       };
     };
   };

modules/flake-parts/nixosConfigurations.stun-0.main.infra.holo.host/configuration.nix

@@ -0,0 +1,62 @@
+{
+  config,
+  inputs,
+  self,
+  pkgs,
+  ...
+}: let
+  # https://console.hetzner.cloud/projects/1982619/servers/47741841/overview
+  hostName = "stun-0";
+  domain = "main.infra.holo.host";
+  ipv4 = "37.27.39.142";
+  fqdn = "${config.networking.hostName}.${config.networking.domain}";
+in {
+  imports = [
+    inputs.disko.nixosModules.disko
+    inputs.srvos.nixosModules.server
+    inputs.srvos.nixosModules.mixins-terminfo
+    inputs.srvos.nixosModules.hardware-hetzner-cloud
+    self.nixosModules.hardware-hetzner-cloud-ccx
+
+    inputs.sops-nix.nixosModules.sops
+
+    self.nixosModules.holo-users
+    ../../nixos/shared.nix
+    ../../nixos/shared-nix-settings.nix
+
+    self.nixosModules.holochain-turn-server
+  ];
+
+  networking = {inherit hostName domain;};
+
+  hostName = ipv4;
+
+  nix.settings.max-jobs = 8;
+
+  nix.settings.substituters = [
+    "https://holochain-ci.cachix.org"
+  ];
+
+  nix.settings.trusted-public-keys = [
+    "holochain-ci.cachix.org-3:5IUSkZc0aoRS53rfkvH9Kid40NpyjwCMCzwRTXy+QN8="
+  ];
+
+  system.stateVersion = "23.11";
+
+  services.holochain-turn-server = {
+    enable = true;
+    url = fqdn;
+    address = ipv4;
+    listening-port = null;
+    nginx-http-port = 80;
+    verbose = false;
+    extraCoturnAttrs = {
+      cli-ip = "127.0.0.1";
+      cli-password = "$5$4c2b9a49c5e013ae$14f901c5f36d4c8d5cf0c7383ecb0f26b052134293152bd1191412641a20ddf5";
+    };
+    extraCoturnConfig = ''
+      stun-only
+    '';
+    acme-staging = false;
+  };
+}

modules/flake-parts/nixosConfigurations.stun-0.main.infra.holo.host/default.nix

@@ -0,0 +1,12 @@
+{
+  self,
+  lib,
+  inputs,
+  ...
+}: {
+  flake.nixosConfigurations.stun-0_main_infra_holo_host = inputs.nixpkgs.lib.nixosSystem {
+    modules = [./configuration.nix];
+    system = "x86_64-linux";
+    specialArgs = self.specialArgs;
+  };
+}