diff --git a/modules/services/server/coturn.nix b/modules/services/server/coturn.nix
new file mode 100644
index 0000000..5af37f9
--- /dev/null
+++ b/modules/services/server/coturn.nix
@@ -0,0 +1,75 @@
+{config, pkgs, lib, ...}: {
+  # enable coturn
+  services.coturn = rec {
+    enable = true;
+    no-cli = true;
+    no-tcp-relay = true;
+    min-port = 49000;
+    max-port = 50000;
+    use-auth-secret = true;
+    static-auth-secret-file = config.age.secrets."services/coturn/static-auth".path;
+    realm = "turn.kabtop.de";
+    cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
+    pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
+    extraConfig = ''
+      # for debugging
+      verbose
+      # ban private IP ranges
+      no-multicast-peers
+      denied-peer-ip=0.0.0.0-0.255.255.255
+      denied-peer-ip=10.0.0.0-10.255.255.255
+      denied-peer-ip=100.64.0.0-100.127.255.255
+      denied-peer-ip=127.0.0.0-127.255.255.255
+      denied-peer-ip=169.254.0.0-169.254.255.255
+      denied-peer-ip=172.16.0.0-172.31.255.255
+      denied-peer-ip=192.0.0.0-192.0.0.255
+      denied-peer-ip=192.0.2.0-192.0.2.255
+      denied-peer-ip=192.88.99.0-192.88.99.255
+      denied-peer-ip=192.168.0.0-192.168.255.255
+      denied-peer-ip=198.18.0.0-198.19.255.255
+      denied-peer-ip=198.51.100.0-198.51.100.255
+      denied-peer-ip=203.0.113.0-203.0.113.255
+      denied-peer-ip=240.0.0.0-255.255.255.255
+      denied-peer-ip=::1
+      denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
+      denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
+      denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
+      denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+      denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
+    '';
+  };
+  # open the firewall
+  networking.firewall = {
+    interfaces.ens18 = let
+      range = with config.services.coturn; [ {
+      from = min-port;
+      to = max-port;
+    } ];
+    in
+    {
+      allowedUDPPortRanges = range;
+      allowedUDPPorts = [ 3478 ];
+      allowedTCPPortRanges = range;
+      allowedTCPPorts = [ 3478 ];
+    };
+  };
+  # get a certificate
+  security.acme.certs.${config.services.coturn.realm} = {
+    /* insert here the right configuration to obtain a certificate */
+    postRun = "systemctl restart coturn.service";
+    group = "turnserver";
+  };
+  # configure synapse to point users to coturn
+  services.matrix-synapse = with config.services.coturn; {
+    turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
+    turn_shared_secret = static-auth-secret;
+    turn_user_lifetime = "1h";
+  };
+
+  age.secrets."services/coturn/static-auth" = {
+      file = ../../../secrets/services/coturn/static-auth.age;
+      owner = "turnserver";
+  }
+}
diff --git a/modules/services/server/default.nix b/modules/services/server/default.nix
index 029b71b..8c6080e 100644
--- a/modules/services/server/default.nix
+++ b/modules/services/server/default.nix
@@ -15,6 +15,7 @@
   #./gitea.nix
   #./nextcloud.nix
   #./matrix.nix
+  ./coturn.nix
   ./jitsi.nix
 ]
 
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 498a53e..372074b 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -1,11 +1,13 @@
 let
-    kabbone = [ 
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo=";
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVQmOem6iMFx1whIpF66B8jv3iWhLYyBkgsl+Bm9LhBjsIrhOBUmkvIA8w0uojxO3XFNqeeyUfsqrAW2PrsNl6JXEDlRw9oaaCH3C0daCxr76peTGxKhXek+kfQIC0HIcqAif+TdmAC3Q6TK3R2/I4yTgt0XOVbkJpOHhbR6kjyTjx1CMEVmbKgduIpeznBDOlC+iotqbchBVQKmnqJt0HNbSFxL4G1bN9UQlr8wzaSf/ZBTPU/ARfES4nrNc4vmztZmsI7clk57JKHFcf19PiMgUWMxdfW5bhMmf/7ARgrk4hZPmWmBnRK1njmFICBuWfAbDx1wnRfDVtSOxiNmMuN3pLUmB9XQCAgvC3kreFs7yDYoYPFcVUA0+AV/hRvB6ISwbsZb9qZSwAVrbnwiMb3e8SJYUb9GKFWPEjNLVYPj66mYH4Hi9FB9q76OQ1kCZthov+pAgy2S4kv0PoqDcpVZxlHsULoXokS2r9yQ/xzQopobbbTkZq4lXv79UZlyrr5zcQ7c4/ojDRxNtFmYlD/dltWWy9ZwcoKioRCFd2CSPRGTx46VClrJ0yJpNX2boyh/Av/6nsucocasLzZ9EHkctvrZQMq3u2FwCQPQ37kdY/JPYpDYKnAJMx4VgLqycbkTBnGDUbHyfVCEEBklTy35JKd73Vm3df7NNk5qA4bQ==";
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo=";
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo=";
-        "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo=";
-    ];
+  #kabbone = [ 
+#    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVQmOem6iMFx1whIpF66B8jv3iWhLYyBkgsl+Bm9LhBjsIrhOBUmkvIA8w0uojxO3XFNqeeyUfsqrAW2PrsNl6JXEDlRw9oaaCH3C0daCxr76peTGxKhXek+kfQIC0HIcqAif+TdmAC3Q6TK3R2/I4yTgt0XOVbkJpOHhbR6kjyTjx1CMEVmbKgduIpeznBDOlC+iotqbchBVQKmnqJt0HNbSFxL4G1bN9UQlr8wzaSf/ZBTPU/ARfES4nrNc4vmztZmsI7clk57JKHFcf19PiMgUWMxdfW5bhMmf/7ARgrk4hZPmWmBnRK1njmFICBuWfAbDx1wnRfDVtSOxiNmMuN3pLUmB9XQCAgvC3kreFs7yDYoYPFcVUA0+AV/hRvB6ISwbsZb9qZSwAVrbnwiMb3e8SJYUb9GKFWPEjNLVYPj66mYH4Hi9FB9q76OQ1kCZthov+pAgy2S4kv0PoqDcpVZxlHsULoXokS2r9yQ/xzQopobbbTkZq4lXv79UZlyrr5zcQ7c4/ojDRxNtFmYlD/dltWWy9ZwcoKioRCFd2CSPRGTx46VClrJ0yJpNX2boyh/Av/6nsucocasLzZ9EHkctvrZQMq3u2FwCQPQ37kdY/JPYpDYKnAJMx4VgLqycbkTBnGDUbHyfVCEEBklTy35JKd73Vm3df7NNk5qA4bQ=="
+#    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo="
+#    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKVDApb3vZ+i97V4xLJh8rUF6z5OVYfORlXYbLhdQO15AAAABHNzaDo="
+#    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB0q++epdX7feQxvmC2m/CJEoJbkqtAJy6Ml6WKHxryZAAAABHNzaDo="
+#    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIIgo4IP8ISUohyAMiDc3zEe6ESUE3un7eN5FhVtxZHmcAAAABHNzaDo="
+#  ];
+  kabbone = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVQmOem6iMFx1whIpF66B8jv3iWhLYyBkgsl+Bm9LhBjsIrhOBUmkvIA8w0uojxO3XFNqeeyUfsqrAW2PrsNl6JXEDlRw9oaaCH3C0daCxr76peTGxKhXek+kfQIC0HIcqAif+TdmAC3Q6TK3R2/I4yTgt0XOVbkJpOHhbR6kjyTjx1CMEVmbKgduIpeznBDOlC+iotqbchBVQKmnqJt0HNbSFxL4G1bN9UQlr8wzaSf/ZBTPU/ARfES4nrNc4vmztZmsI7clk57JKHFcf19PiMgUWMxdfW5bhMmf/7ARgrk4hZPmWmBnRK1njmFICBuWfAbDx1wnRfDVtSOxiNmMuN3pLUmB9XQCAgvC3kreFs7yDYoYPFcVUA0+AV/hRvB6ISwbsZb9qZSwAVrbnwiMb3e8SJYUb9GKFWPEjNLVYPj66mYH4Hi9FB9q76OQ1kCZthov+pAgy2S4kv0PoqDcpVZxlHsULoXokS2r9yQ/xzQopobbbTkZq4lXv79UZlyrr5zcQ7c4/ojDRxNtFmYlD/dltWWy9ZwcoKioRCFd2CSPRGTx46VClrJ0yJpNX2boyh/Av/6nsucocasLzZ9EHkctvrZQMq3u2FwCQPQ37kdY/JPYpDYKnAJMx4VgLqycbkTBnGDUbHyfVCEEBklTy35JKd73Vm3df7NNk5qA4bQ==";
+#"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIANmaraVJ/o20c4dqVnGLp/wGck9QNHFPvO9jcEbKS29AAAABHNzaDo=";
   users = [ kabbone ];
 
   dmz = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwN8p78OncPIRUfV64PLHOem4LtlQ3opOJwLEYqdGVx";
@@ -21,5 +23,7 @@ let
   ];
 in
     {
-        "passwords/services/mail/mailjet.age".publicKeys = servers ++ users;
+        #"passwords/services/mail/mailjet.age".publicKeys = servers ++ users;
+        #"passwords/services/mail/mailjet.age".publicKeys = systems ++ users;
+        "services/coturn/static-auth.age".publicKeys = servers ++ users;
     }
diff --git a/secrets/services/coturn/static-auth.age b/secrets/services/coturn/static-auth.age
new file mode 100644
index 0000000..6fac7de
Binary files /dev/null and b/secrets/services/coturn/static-auth.age differ