wow

hosts/server/natsu/default.nix

@@ -12,6 +12,7 @@ nixpkgs.lib.nixosSystem {
     # ./services/attic.nix
     ./services/caddy.nix
     ./services/forgejo-runner.nix
+    ./services/rtmps.nix
     # ./services/harmonia.nix
     ./configuration.nix
     ./hardware-configuration.nix

hosts/server/natsu/services/caddy.nix

@@ -91,6 +91,11 @@
     virtualHosts."blog.imnya.ng".extraConfig = ''
       reverse_proxy 127.0.0.1:4321
     '';
+
+    virtualHosts."rtmps.mizuki.guru".extraConfig = ''
+      respond 204
+    '';
+
     virtualHosts."netbird.mizuki.guru".extraConfig = ''
       # Native gRPC (needs HTTP/2 cleartext to backend)
       @grpc header Content-Type application/grpc*

hosts/server/natsu/services/rtmps.nix

@@ -0,0 +1,60 @@
+{ pkgs, ... }:
+
+let
+  domain = "rtmps.mizuki.guru";
+  caddyCertDir = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}";
+in
+{
+  services.nginx = {
+    enable = true;
+    package = pkgs.nginx.override {
+      modules = [ pkgs.nginxModules.rtmp ];
+    };
+
+    appendConfig = ''
+      rtmp {
+        server {
+          listen 127.0.0.1:19350;
+          chunk_size 4096;
+
+          application live {
+            live on;
+            record off;
+          }
+        }
+      }
+    '';
+  };
+
+  systemd.services.rtmps-stunnel = {
+    description = "RTMPS TLS terminator for nginx-rtmp";
+    after = [
+      "network-online.target"
+      "caddy.service"
+      "nginx.service"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "nginx.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "caddy";
+      Group = "caddy";
+      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "rtmps-stunnel.conf" ''
+        foreground = yes
+        pid =
+
+        [rtmps]
+        accept = 0.0.0.0:1935
+        connect = 127.0.0.1:19350
+        cert = ${caddyCertDir}/${domain}.crt
+        key = ${caddyCertDir}/${domain}.key
+      ''}";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 1935 ];
+}