wow

hosts/server/natsu/services/stream.nix

@@ -0,0 +1,72 @@
+{ pkgs, ... }:
+
+let
+  domain = "stream.mizuki.guru";
+  hlsDir = "/var/lib/nginx-rtmp/hls";
+  caddyCertDir = "/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/${domain}";
+in
+{
+  services.nginx = {
+    enable = true;
+    package = pkgs.nginx.override {
+      modules = [ pkgs.nginxModules.rtmp ];
+    };
+
+    appendConfig = ''
+      rtmp {
+        server {
+          listen 127.0.0.1:19350;
+          chunk_size 4096;
+
+          application live {
+            live on;
+            record off;
+
+            hls on;
+            hls_path ${hlsDir};
+            hls_fragment 2s;
+            hls_playlist_length 10s;
+            hls_cleanup on;
+          }
+        }
+      }
+    '';
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nginx-rtmp 0755 nginx nginx - -"
+    "d ${hlsDir} 0755 nginx nginx - -"
+  ];
+
+  systemd.services.stream-stunnel = {
+    description = "RTMPS TLS terminator for stream.mizuki.guru";
+    after = [
+      "network-online.target"
+      "caddy.service"
+      "nginx.service"
+    ];
+    wants = [ "network-online.target" ];
+    requires = [ "nginx.service" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      Type = "simple";
+      User = "caddy";
+      Group = "caddy";
+      ExecStart = "${pkgs.stunnel}/bin/stunnel ${pkgs.writeText "stream-stunnel.conf" ''
+        foreground = yes
+        pid =
+
+        [stream]
+        accept = 0.0.0.0:1935
+        connect = 127.0.0.1:19350
+        cert = ${caddyCertDir}/${domain}.crt
+        key = ${caddyCertDir}/${domain}.key
+      ''}";
+      Restart = "always";
+      RestartSec = 5;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 1935 ];
+}