Fix TLS certificate handling

hosts/magnesium/services/coturn.nix

@@ -37,9 +37,6 @@ in
 
     no-tcp-relay = true;
 
-    cert = "/run/turnserver/fullchain.pem";
-    pkey = "/run/turnserver/key.pem";
-
     no-cli = true;
 
     extraConfig = ''
@@ -80,9 +77,19 @@ in
   systemd.services.coturn = {
     after = [ "acme-finished-${fqdn}.target" ];
     serviceConfig = {
-      ExecStartPre = lib.singleton "!${pkgs.writeShellScript "coturn-setup-tls" ''
-        cp ${config.security.acme.certs."${fqdn}".directory}/{fullchain,key}.pem /run/turnserver/
-        chgrp turnserver /run/turnserver/{fullchain,key}.pem
+      Environment = [
+        "CERT_FILE=%d/fullchain.pem"
+        "KEY_FILE=%d/key.pem"
+      ];
+      LoadCredential = [
+        "fullchain.pem:${config.security.acme.certs."${fqdn}".directory}/fullchain.pem"
+        "key.pem:${config.security.acme.certs."${fqdn}".directory}/key.pem"
+      ];
+      ExecStartPre = lib.singleton "${pkgs.writeShellScript "coturn-setup-tls" ''
+        cat >> /run/coturn/turnserver.cfg << EOF
+        cert="$CERT_FILE";
+        pkey="$KEY_FILE";
+        EOF
       ''}";
     };
   };