From a455c781b0bbb381d3f9cc6186edf305e304b11c Mon Sep 17 00:00:00 2001
From: fredrikr79 <fredrikrobertsen7@gmail.com>
Date: Sat, 29 Mar 2025 20:53:33 +0100
Subject: [PATCH 1/3] coturn: add systemd support

---
 pkgs/by-name/co/coturn/package.nix | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/co/coturn/package.nix b/pkgs/by-name/co/coturn/package.nix
index d0eca5422fa1..9bd5ea132869 100644
--- a/pkgs/by-name/co/coturn/package.nix
+++ b/pkgs/by-name/co/coturn/package.nix
@@ -9,6 +9,7 @@
   libmicrohttpd,
   sqlite,
   nixosTests,
+  systemdMinimal,
 }:
 
 stdenv.mkDerivation rec {
@@ -26,13 +27,17 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
-  buildInputs = [
-    openssl
-    (libevent.override { inherit openssl; })
-    libprom
-    libmicrohttpd
-    sqlite.dev
-  ];
+  buildInputs =
+    [
+      openssl
+      (libevent.override { inherit openssl; })
+      libprom
+      libmicrohttpd
+      sqlite.dev
+    ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform systemdMinimal) [
+      systemdMinimal
+    ];
 
   patches = [
     ./pure-configure.patch

From 1a1b23399858b40bb09e377c380037bae6a56dca Mon Sep 17 00:00:00 2001
From: fredrikr79 <fredrikrobertsen7@gmail.com>
Date: Sat, 29 Mar 2025 21:00:53 +0100
Subject: [PATCH 2/3] nixos/coturn: switch systemd service type to notify

---
 nixos/modules/services/networking/coturn.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index 2c89c3a12fb5..95372945d91f 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -363,7 +363,7 @@ in
               chmod 640 ${runConfig}
             '';
             serviceConfig = rec {
-              Type = "simple";
+              Type = "notify";
               ExecStart = utils.escapeSystemdExecArgs [
                 (lib.getExe' pkgs.coturn "turnserver")
                 "-c"

From 0e68b25955b7a844b80b603f162af2183e30756f Mon Sep 17 00:00:00 2001
From: fredrikr79 <fredrikrobertsen7@gmail.com>
Date: Sun, 30 Mar 2025 17:49:59 +0200
Subject: [PATCH 3/3] nixos/coturn: allow unix socket

hardening previously disallowed unix socket, which is used for the
systemd notify communication.
---
 nixos/modules/services/networking/coturn.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index 95372945d91f..044d3ba0b791 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -413,6 +413,7 @@ in
                 [
                   "AF_INET"
                   "AF_INET6"
+                  "AF_UNIX"
                 ]
                 ++ lib.optionals (cfg.listening-ips == [ ]) [
                   # only used for interface discovery when no listening ips are configured