kill TURN server

1. It attracts more script kiddies that an open van with
   a "free candy" sign
2. It never really worked because no one knows how you're even
   supposed to configure it if your server itself is behind a NAT
3. It's 2024, IPv4 can just fuck off

configuration.nix

@@ -43,8 +43,6 @@
       443 80 # reverse proxy
       993    # imaps server
       25 465 # smtp(s) server
-      3478   # turn server
-      5349   # turn server
       3551   # apcups
       18080  # monero p2p
       22000  # syncthing transfer
@@ -53,13 +51,9 @@
     firewall.allowedUDPPorts = [
       443   # dnscrypt
       53    # powerdns
-      3478  # turn server
       21027 # syncthing discovery
       64738 # mumble server
     ];
-    firewall.allowedUDPPortRanges = [
-      { from=49152; to=49999; } # turn relay
-    ];
 
     usePredictableInterfaceNames = false;
     nameservers = [ "127.0.0.1" ];
@@ -177,7 +171,7 @@
 
   # Allow read access to ACME certificate
   # to specific (service) users.
-  users.groups."maxwell-ydns-eu".members = [ "murmur" "turnserver" "nginx" ];
+  users.groups."maxwell-ydns-eu".members = [ "murmur" "nginx" ];
   users.groups."riot-maxwell-ydns-eu".members = [ "nginx" ];
 
 

matrix.nix

@@ -75,14 +75,6 @@ in
   services.matrix-synapse.settings = {
     server_name = config.var.hostname;
 
-    # Tell users about our TURN server
-    turn_uris = with config.services.coturn; [
-      "turns:${realm}:${toString tls-listening-port}?transport=udp"
-      "turns:${realm}:${toString tls-listening-port}?transport=tcp"
-      "turn:${realm}:${toString listening-port}?transport=udp"
-      "turn:${realm}:${toString listening-port}?transport=tcp"
-    ];
-
     # Bind on localhost and used a reverse proxy
     listeners = [
       { bind_addresses = [ "localhost" ];
@@ -130,7 +122,6 @@ in
     expire_access_token = true;
     event_cache_size    = "2K";
     max_upload_size     = "1000M";
-    turn_user_lifetime  = "1d";
 
     # bridges configuration
     app_service_config_files =
@@ -140,10 +131,6 @@ in
   # Secrets
   services.matrix-synapse.extraConfigFiles =
     [
-      # Needed to restrict access to the TURN
-      # server to only our matrix users.
-      config.secrets.matrix.turn.conf
-
       # Password reset via email
       # Note: can't be put here, see NixOS/nixpkgs#158605
       config.secrets.matrix.email.conf
@@ -171,47 +158,6 @@ in
       LC_CTYPE = "C";
   '';
 
-
-  # Handles users behind a NAT,
-  # needed for reliable VoIP.
-  services.coturn = {
-    enable = true;
-    no-cli = true;
-
-    # Only allow users vouched for
-    # by the Matrix server.
-    lt-cred-mech    = true;
-    use-auth-secret = true;
-    static-auth-secret-file = config.secrets.matrix.turn.secret;
-
-    # Use maxwell certificate for TLS
-    realm = config.var.hostname;
-    cert = "/var/lib/acme/${config.var.hostname}/fullchain.pem";
-    pkey = "/var/lib/acme/${config.var.hostname}/key.pem";
-
-    # Port range for TURN relaying
-    min-port = 49152;
-    max-port = 49999;
-
-    # Enable TLS
-    secure-stun  = true;
-    no-tcp-relay = true;
-
-    listening-ips = [ "0.0.0.0" ];
-
-    extraConfig = ''
-      external-ip=${config.var.ipv4WanAddress}
-      cipher-list=HIGH
-      no-multicast-peers
-      no-tlsv1
-      no-tlsv1_1
-      mobility
-      user-quota=12
-      total-quota=1200
-      verbose=true
-    '';
-  };
-
   ### Whatsapp bridge
 
   # allow synapse to read the shared secrets

secrets/default.nix

@@ -1,69 +1,66 @@
-U2FsdGVkX19e9jNajNyg+sDJ7PtS9BWFP3s0pBLZxGljaYrMqZPI2Taqy8V8sME1
-IAT59TnRs33e9Zb8bv9rzOCKw+sPYi+h3Bp5vSvKTJKK1q3ofyq0TnRr/5rz1+4D
-5uX4VBxMhR8lUu/XYWCejc2ipHtO/+CLFF0jNqN8InL9jqRlYlhM9H+zvG5TbP+t
-iUwthAfhHZV2qrTDi0B7WUJsSYbLGpE+R93LT8AIjgC9n5/81FlZw+uVpQTvI2QU
-IplU15cbYI153ZS2ea1g36NGuEh6NTPLYHoBXFxdsgyV/6WC99mjRb+W9sy/LeGt
-fXLFzHZRKpK25KiiFD0QoNIRwbqw5ztLEJ/gdvycnoLLUPj21Myw+l7Oun1u6+SS
-cVqYAO6mre0ygFybpClA64mz6sgoLSCdi3JZ9VsXjx7FXRuNptpghLALkR5iNL06
-Jvi4pNCWOkblndWbvljPyngRgLB5vsjSnFsmSJ4HR8/ViKwmnpuAhPRCPamVfgNg
-ijJk82n43RVt9En44BbaItwxe425/vo7MiuoLMGd6qm0ps3SWQflcXEZxpkKFiy3
-1XeJASCsLMWABAf1noKhCowaUoOR4JMpbmULBNXLP6osimZEbt8LCcobsJ70TZRd
-ojJJGcFqmiNmRr4j2R/TCIpbY/ZUCNwkY9WHGQ6RSTb9sN07YU9Juab3rR92z2jj
-CRbDGJl/+iizHdtACnmLOVQ5WlezGgAg3Sz30EU9/m3yaP5pnoeajeOZnKCFsw7O
-LIxI5CaFA1RT+EE1UpRiKD0GZL7TyMlmInxxirPfKx+hf4rONglDnShOtbIxrDLl
-0teJChhSg4yVv1BwnNMrxqng2GqcCxtb76e4Buon7ReVucX85N5HHzKzdVh6oXE+
-XzfwsJipOatiERP2OltXHdCrp8LzC9J0m+718cjp1HP5ny639UclNKaKhazWa3fs
-XzritJzKErCo0horAAwGA3YSNbT4jxpbaXMTL64wzgmbA2lwbIXVqAI0N2ENYSta
-JiTnYfbDaZDPg1tkYIaPmS/7Qp3ykxvox044Iee5WBV4ZpPggpVzLt/FcMR3NFjj
-F37bdxO84q1jAqY51JppfS/WbFws4ex5FIz6HWvr4IlbSoHLPPK/9oUJpoZfsnPt
-3olO0CFmyyfbaqbt8yPBDNRODniiDG2qzI4QEhxsgWyRocuEe+lMxVxg9HjIN90a
-aRbIdOtc50IHMysKwhn5RJcsfjfwPjc7LvmggxrRLwbJN1xOA3NOxIqubmMwYpl5
-wNzJn6WcAj0CxU+iTYiUWROzlFoNNccRZq4hLzGD9AGC9dASaOlvovGCDwPoyWyP
-qZRLIn/AxdourmkOG9F14iz67GyeVdW5V0aLOsVC+zjcUfQ4IuYv6nW21mcJ49sE
-ZwcxAUel0k5WzrFriqXG/09DaDSpIqyMsis+6ARav0h64/KmnWZT2ZbZ23445iX5
-q9vkePgY3TYBAxbq2ftvPMwbMAuq3yWPrZhdy+UMVgrjvpFoStK93fNXq7RO9X0L
-TOq+PMi9JBKJbCvl6q0ImfXoyZ9oPM6RIIFEBx1I1euSZdbgEc6gULvXMHBxxXtS
-e+YPB9+qOEhAQKzgOoWgmItRJ8l3PVBMIhSRy/Lmkwkwz4SGssJkaLthk5oRJsk0
-7AHS97QAk/bWbmHtIoj0VmMq3HdLKs3GJYWmEyu4VfQuRWPMVVpOqv5Td8B6tIvc
-0vab6t8Ja1TQo+zh4Ru4VejsQVp646sZczETcku2L28Oms7g9yF+6BW7hbO/5Hqa
-qCPPcJJIy55WSxA0beJzcpPHWdFXUPRArO+WB0XKf2BC1W8/XwRcnF7UuDgOyuKP
-1BAn3vJX5h2fhF9cuCyDEZqkWqCwCcE5asaLIO0c6skmL4YeZcBUB7STSQ1x9vjW
-Up4P6hUB9Ni9vP0hsdSrFFcTicOjhhoG0TspdoT86wEZsSZJ2v4ufIc2DrOIbgxp
-2C2VoxQMuARXv+TVNtBDyfnh5EoYQYyX3h1ORm0c3xMWnlgVYqXvypEnSFMhmQto
-l57yGIqUvvOEjfeQJ29nM4TGCYW61rSygd8cX2cUdk76iyKgS/CGtRYgyyhxAQ2n
-t0b9bQr/P3eyUnTecu8TkqVevD9NNkamZASIcPnZmFIc+8fmsoghvm1eRv0rPj0i
-F+qMKZhL4EaeGlYrLxkLrHv/r5Y+OwmDav6t+PL9XmGD89cXvcYRPhDjlAaDKD7V
-YHnFEkBoAiy6m1C84mFrBmXqbqXMvgyDdtfw2a0mSZ8dWHOvYa3GsCmI36D5jOnO
-ob5oyq12wSigADixuua57kzJM6yhQy4dNTa9jgq/98r28y7OtsZtQhWItfXnXOs3
-7/E/TMpc71qKAqGTysyTQ9hrQjy6d2wdC0TFOkYuPbTLg1fItJotlAqRc8P0xzUC
-4TIrR9Mu7ujG+vVDXTPihmbwc8bo5vuUdeSLOtD1ma+Q+v1E/3YyIADxVK8yaxCg
-XAtcm8miVmcoLo/v+7xAP2JX6IEGW2nQAEVeicpO9SuT5eHaHw1lvcsL1po5ZDQh
-LcuSIljmYgqj0WnaNUkbJfbYocUMxMhUgDcKOv3ACDMjOash0L75ivdO/whVClP1
-Tc/u01gg90joszXrOAbm2X2copt8B2algJPnSA9FME1+rdsPF8objEzsHB2wAAVR
-9lSqEZyTLbpJ8lr5SrGDwNmXb4akwpGczDNAdNLma0Mk3ysjFCsi2ll3HODFOqXr
-UbxhA1C8V6hT/E7oUVDzMmvR5NnIB4RO3EIudoD7uzPnLf0L9PHKbjPMbMHeElcd
-s9QZOo/VRXrdfOXgpSxckwmfBu4CqvWiugjl1TbAC6dGfS1NMpbU5i8zz8c1805R
-2f2WFux2KWfkMYddBOeReOD0Cj8FwajxZ+Jb30GBP9L38fdAmjRcWLVPSc4nKYwv
-QH1tWn/rRirPtapYlQ0vDzoeBCWDudpKSXCc3WbPwOEwkitiGLIUV+AIVulAIk1R
-0QVTpZ2nULF88WLFXZyWpjNwFkWpKyPdhYZXF9L71xHA7SFEF7nLZYFuUXTmUQX7
-rWaasE8PANtcEpYWfqHuzja+8WN146qkYnUsmVNGZt7M5HUZblZmBvJ0aYfoa7+H
-XNavEewQ/gnxfVggY1zWRLipghNZABzoqG2xCew6Kga+V3n2T35h58EcGX+gAu+A
-hknbOgWBxGYafoxaE6MI3TZXOQ9f4EK6pKtEeZPxp1M+WT6nKv+3VxI5O0BWNuTI
-XhvCuyNEhNlt8u7gQRvyqPrF8bpIcka60SW8IfMrN7c1y3SJGhRGHAdcg4v8buZx
-lqwL4Ur/se3JP8SUI12TOhwhENAI61fwUixb2R3Yjq0ITWBNm5rf5g6uv/hcucAu
-BRLDNU7XnuZ/c1hKEQxwTs5M7e/sgu4EJMZ60kyJJNM+UzLsjHn/Pp426uK99NF7
-/xHHfPjIrp4wnDNMUgxKnUJVUg8rtlrS/kkwNwL5iW3sD6SQd0BJRJ67kwj3JZaG
-qYtlvSlb7PF3vVbqPIf7+mAvgAZxWukuMHq1Yh8EFfKqys2bsV8gWmw8eG1Lj69M
-qUGQAdLtvULaqJXmc1kerxcpyhq4AHuw7aM7sv4H1E9bAYfO0mPOJS4CiiY8JPID
-HfptXRW/4u3CXTXjY+tEvAP74ELmYwATJtVyiVdiDyZEr/vM/ZtJZEkKet2IKA/6
-BmA4f6OPGsjxeIL/0kFcJnAvbp0JEs7gKLJjb6TrCKU0dOwCLE3CSLpkE3jNuPfH
-y+JcC+0ot9ZWw6uYXeXhO0ovzkfpkLXE7zWjs3aA2VLqrskJwz5xzQGD4hSqwyrX
-B5//GmUYzVy+sfAg0yskFx1vUmXzeIBaTkSy8cxF3yE8P0twS9GU7pEKHqSebZd6
-v6MDCXIPP4mG/pRb5OBwWzCHjzAqyeuf3FkACWfJljrtcnqVJQGqzAnrlowbMnGd
-tRNGNXadSdpkL8bRw+5K22cC/JxZ+voVyOw2lridpgr+ekHBkzo9wXqDNk9jYEr9
-aZnQpSag3AMQxC42xghiofdn50g0/MtWQOhE8sRmGU60OBesQP6mO1kPrqiUAnsi
-mHfzpYoFonhac2DEriZSDB9cDLrk+MUdK54cHoTcUYIt0Zw/Vs1U4eftCYewCdow
-dAEvtI+WzNM4dHwj4SWH6F6dunSfuFVe+qplz9RldGlAFSCDskQA5b77vmDKSmnQ
-FIIuNbXqsgwC8QXcnW/PipDdG0F7mOvAppDM5tvtI8mcVJD0qR5tk5Wq2YGm3YF8
-kmRXQB9s2Ip0UeOI4bHc1ZZx8UxEAXbfWwhGeCKvUawYOiBUyctOmvEH8cgiGCK1
-YTTU/1DF5HZJdxRx0yNwzhkxIUDCpSZzehENu0rA
+U2FsdGVkX1/ZJj5EU5b+BSTf5NlPUY/G67cJHbDVBovQKquVFMf1P+ZAcmIV62qA
+HbyNN08YRY65vgRzWtU6wRg3q7ifWN82keCjX29Z7S2vYXCzi40UHPmRBBRawVY2
+9pjng2Zo53csln9O+MZAPeVV1E85WI3iLvfX+dhvyDzwzFQ3BxdL824MxctLTJPt
+Ja/GVm0CYcPZTJTzPXJEBUwZxu/oc2HHv9OR9a5I8gqyZOwAiIXQ8rTSU2zPzulp
+xoKL9RgtYonW1UT/XZHOsDEk9Xdd1EcbY1chumYUErtKTouRimWrjnTePsYcQy6f
+griuXE4Lb8xFu6oxsY7Kziwo5B2r5to8dLB0soOWCSImRBy11ntqxezOY6+43YIa
+FUtSTdzBq171tQ5opAIuiCLAos/94rKiktxAEbTMScsJbubvPex1qGTGG1Cvj5hZ
+mA54Elpsjup7rdSkcYVTXojoDA/VR2HP90coBpYD6qRj8IdPfvs7fQu46BQSGKN6
+3VVgmHiMhfraefaL5ldqr/M8FS6vyXSJV9KR7TQ6ha3RgPSYB3EjsC0LRrENuYRO
+eO6KXxmYj3iFtud7gIulsiKXD0WdzPFMH/Od/Tu6LLAFCqFyIBkVuwksxNlHCZ/H
+6ayiSSLNwviY6xSYvZURY7t/l8SCiikRyIsdSR6b+oe+mwkAZ7W9XwLLZc2G2oCd
+FTzvcRv2o9eKr/pnXFPpMgTJ1LJp7wiLOf7xcDY2mZV7mCVm7+3Hzc4W0tiEQ4Uv
+vDSofcTfWZV2PZftekk3//Yt8hLsH1JgtvPxNWtVC+U/504R0FtV4YbYOm98EJJt
+j5ufDSRvo99v+wyokkq4Uv8ysHxTXLeQ4VwxDOvkjRnT4P5QhhE1ontJJWHAuPne
+6JmWMUihKBNz/PKL3tloXWjrf/bfdSfbDh5vYI0C9B6LhnQPeBOjgfdVzuoMvCJ4
+EH4Btz9qtELlNNnWFXIB0n5mBlAIflILpLi1dD5900KQd0T5U2eJh6S371HLqjaq
+pQoBIQfGFKDy9dFUxHKG2A76KfoTvBSNw5/ZxSbMZ0+YEToX0LRQ6Vz7Yqn/TDBn
+cBBMyuBE88xsEC7TluKd88EYhuE0LAVY0SgiHCsRDs2fwrLO2Th0mwHqQJvb9dwz
+h3g7RgM0+nZZXGUl1U81XNK/TB1jj28KyFYBV/sXAqBOiJTwUx86lNYIhJ88l+B8
+hzlYT1YmgmeiRu+wtIfBPyhpFdyWIK3eY3C/YI3Uh2GN2ulHrPjJLusefzd3EWQz
+MS8bNOx39v0dl8oI4Mgmu00dy8uwFzr1tA4XUKmo2bXX7aEV7c7MRYZNRYxukq8n
+HPKH8/gmlpMdK2WoMwgRuJCGZaW/9ruGYlJArzViHoBeypyn/TZOxGLTKqfStcX+
+VdP03n2Wa5E3b1p5eqdJ7xUAl6qJQeT7LoWMTZaPkAEEmRoDembMe9JKxW4qRzzY
+Ez5cKscrEI32m0Owa2u1enRLQ037s5ow9chYbAenaHuKL9aHIqr7ktcrEqC0f+sB
+GSQ1MDiArNmAKDoFj0c1tiByLcuc6vKqLkE8OUmiPy9Yejldejpu2TAH/OHl8Rrc
+xvGKYLj+R7przdoklFDgVVXIoJywv1KKdmhjnjKUjX5c294Xi7eZkbFXTX9MIZ27
+EZ/Sj2paCaSLOo9Z5j0xFWHKMAkIKHSmcFsRPrulA3V8W9ox1VbXcpR0XRItNBgw
+I9BWKvAXwiwB78JXlhacglr/Pc7B4B180qXHMR28YDi578PhiTHUstfoD2aBDePx
+LEUe4+ibp4aBMgCh4Aup/JFx2YaXwoQUeJQnF9YxMpPhmrGbl1/XyGIR4AdW8nf8
+wD7JR0G9PQnn9HUi6j6JaO7ONwwVoeV7greMHBPSMLSQMlrjcUSM0NQ+A2GNCcMK
+vMQkDXx/za8wkCPdBCRYUSv4zqeQocTxTH48InVg4/gAXp52L7vYPuGA3G3JMtI5
+f5C0e2y9swUmeBTT83taY0p99xVJF+c62J7vbiEa8pkqtz7HMet25nIpEguewzMk
+JQdmDVPjxXheIbWphE87UN+ePVkfie6o06/wIb/ug7rAKKeVP+CQT9/w7h+ViZ/m
+Z4QMgMuevZ2hHVNRePSgOPS0OQ/LqrKm2PGokgYplirtL/BORObb3QwgKQ5ihNto
+9U2YzoAKPhGYj5o0FYBzKlUt0JatGhpTDQQZz7Y7yrJDIZ62IvTJgmfMALmbXovD
+oRWVFKeafV/1XQtJ7PxFyHyVfjHVch6luAv+ziCECXmWz4m5liCdh65lu6Ff53Xa
+T8yLHV+2UwCmc8gzuzdFa4RJDSx0+UgoA/GUCnqmkQVbNBFtzLq9zXtQhyAXdcSQ
+dfYtIW2XddiZV77pr8j8M+CrvaxGdzSU63MDYfWbo2evye1teGD2ygZuxWFAvk5k
+wdBeb1Eggj0nwweNXGDtr0xEL1BPgaBQlxOe9cQwan8Flc+NgWDqVmpvXuuGORfA
+SGrHgzWvHQ+Y0UOKj6ObkSUOsIBzPyh8T6TnjYyX+rL6RJkelpGtKYOLvM2Nw1xu
+LBofbmpy+LS1xnToIlXlawvhucsHTt2mi0PQShTJslmxurYhGZQ1Ubn5HyncyhTt
+av6lq46bV/1MUE6yGI8NxfjEH4Sbafh088S1rYSkcy8FZOZHwJNA1EPJetSNqdX5
+3KVRoOlx1Yk1ow0d3kG3Df6X3xOuGFbLuEd4vbi3DbgYBQx2EUBRODjBYLg4ccOY
+S4DjS6BFnddQ/tNjnyafiuatvR1LUYS+wKknvhehepOO0KceeMqCPLowR1y0r56R
+Y23cBLd+QRjaaRpE/hReMhv7xMYbz/F1E81cTaxdcsY3pNIsKwrHDi4aK1ePlvra
+Woi0TKNwp1U2vNL7eV2y6oaHIeMeXsLi9r8cuk+ENl35BK2nwXfW5Pbid18HzGje
+CbIgXKgbHS1k5rTc/Qb20lLes5A/pbCtNaR6Z0jrp4QpBJwa7uSrwLCR18E1W2mt
+EDfL3j4kpCldbIA/FroVqJydmBk06+VoZhFL+C5uVKXyyrSjtq2I2XKSMxscpF2u
+42rUCQGbPM0Po0WrICqKTdXchJ1Hk69lvjvoi1ezcVNcRVkK7yPCAx2mNd+bFdtm
+dz2TO4imAwEQIo9qfqEWGLMC/3h7YxmdlGLcgEZ913UtCorr0igTVpNFY8FnIjfq
+rpbolTCkz1a2kXu3zO2423X0DnieUWMmBVL4A9hUHDU+Yglo9Np1ZTfHHraCcU7l
+2GHiU3Uf3uxjfRMzKC4JOoDyjxjLdbKL7r6Q9Pu0FWZhxTRt6UTUEHzmqvGB/j6Q
+EQfT9GP0v8gcaDCWWULoUF9fNpVoLIq0EDCB0rNfdCDIzSJrDy0lwdDstVFJQUit
+lz7HD7sysoR3ToqcLeR11qQongQtYoq8oBr8Zsw2dkusgqnhJKMYf0XEDSH54JvD
+iWa7QCFmFS6P9O8NXGuCMY528XbEtKGJEqaYINxReF+UVbG/xAum7hBXSYpOm22U
+h5tNxNLv5Quua2eqNZuhcoMIW06oOTpGS6nIuyXDps34C162w3nLkPNry9dSRsLG
+N2aHbOHVpegwyP+wxkVSAXIBx89Y8opWApt6tXmm8xQJEwoj9Pd/ph+IiVOA9WCd
+PJobE0AXz9c5civRQXairp2/oz8FDR+nB7im6e+FHU+p1dsTXe91CJtuI1GwzSF5
+TacW4CupcTFv2Dhv5v1x053tR1n7tYNWpx1i3TPw9aJrRO6ltSaDlkSk6spbF5ul
+/cIINDjUoxmOS3C3GOYw6n34ayPDDX1C99qjkGZGP5FMM8BZrsaq5wqoJr4WuM7v
+B9hIyMOydpTyIxAMJlrApuh7bcVnpsCCJjBqYCKB+pq2mLg6ZTKP+aiRoILZy++L
+4p2P72PJX95zxCXqBemHJ26u4yYMOLoz3asO5og08eO6YlD2Kva7E2diwwQ5vnwd
+CkyW3JSbs8nL5eVFGVSf8wt0ADgIDgMzYk/wn2eSF96AitnMQcEMG5cp2aF9ulBE
+Gg+6Yyr6Xnpx+Sfyij0c5lhIP52eor3QIJPKElW8zorEnviysvo8E8LRtHUZLl8Y
+fXQPCOo35Gc+53zLijUuHUsg5yKJlZ7gevsTFxJl07G/3BUK+SKhLoFDJ9m15RTX
+AWT9pwR8BMGdUUdT4izlL8xG+w==

secrets/matrix/turn.sec

@@ -1,2 +0,0 @@
-U2FsdGVkX1+mkPj37zyGLNB/Qg6Q3FjuEP4Ui1J2FoFFsgsJYvAnKqJPtfPo0NR1
-wW8teMYlxw8=

secrets/matrix/turn.yaml

@@ -1,2 +0,0 @@
-U2FsdGVkX18oUm7/hmXd15uxhFTGsOoCuLTVYTWCdEcdAy7is9ABVXi8sQ0LEd2f
-A6RiB4GsVavTcFi/rFHZXCs1r800TDHj1lNieLw3