{config, ...}: {
  services.matrix-tuwunel = {
    enable = true;
    settings.global = {
      server_name = "nicknase27.com";
      address = ["0.0.0.0"];
      port = [6167];
      allow_federation = true;
      allow_registration = true;
      new_user_displayname_suffix = " ";
      registration_token_file = "${config.age.secrets.matrix-register.path}";
      unix_socket_path = "/run/tuwunel/tuwunel.sock";
      unix_socket_perms = 660;
      well_known_client = "https://nicknase27.com";
      well_known_server = "nicknase27.com:443";
      msc4140_enabled = true;
    };
  };

  services.livekit = {
    enable = true;
    keyFile = config.age.secrets.livekit-keys.path;
    openFirewall = true;
    settings = {
      port = 7880;
      bind_addresses = ["0.0.0.0"];
      rtc = {
        tcp_port = 7881;
        port_range_start = 50100;
        port_range_end = 50200;

        use_external_ip = false;
        node_ip = "130.61.151.118";
      };
    };
  };

  services.lk-jwt-service = {
    enable = true;
    port = 8081;
    keyFile = config.age.secrets.livekit-keys.path;
    livekitUrl = "wss://matrix-rtc.nicknase27.com";
  };

  # Pass homeserver restriction environment variable to native JWT service
  systemd.services.lk-jwt-service.environment = {
    LIVEKIT_FULL_ACCESS_HOMESERVERS = "nicknase27.com";
  };

  age.secrets = {
    matrix-register = {
      file = ../../secrets/matrix-register.age;
      path = "/run/secrets/matrix-register";
      owner = "tuwunel";
      group = "tuwunel";
    };
    livekit-keys = {
      file = ../../secrets/livekit-keys.age;
      path = "/run/secrets/livekit-keys";
    };
  };

  networking.firewall = {
    allowedTCPPorts = [7881];
    allowedUDPPortRanges = [
      {
        from = 50100;
        to = 50200;
      }
    ];
  };
}