wow

hosts/server/natsu/services/rtmps.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }:
+
+let
+  domain = "rtmps.mizuki.guru";
+  caddyCertDir = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}";
+in
+{
+  services.nginx = {
+    enable = true;
+    package = pkgs.nginx.override {
+      modules = [ pkgs.nginxModules.rtmp ];
+    };
+
+    appendConfig = ''
+      rtmp {
+        server {
+          listen 127.0.0.1:19350;
+          chunk_size 4096;
+
+          application live {
+            live on;
+            record off;
+          }
+        }
+      }
+    '';
+  };
+
+  systemd.services.rtmps-stunnel = {
+    description = "RTMPS TLS terminator for nginx-rtmp";
+    after = [
+      "network-online.target"
+      "caddy.service"
+      "nginx.service"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "nginx.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "caddy";
+      Group = "caddy";
+      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "rtmps-stunnel.conf" ''
+        foreground = yes
+        pid =
+
+        [rtmps]
+        accept = 0.0.0.0:1935
+        connect = 127.0.0.1:19350
+        cert = ${caddyCertDir}/${domain}.crt
+        key = ${caddyCertDir}/${domain}.key
+      ''}";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 1935 ];
+}