65 lines
2.4 KiB
Plaintext
65 lines
2.4 KiB
Plaintext
|
# coturn TURN/STUN server for XMPP Jingle audio/video calls
|
||
|
|
#
|
||
|
|
# Credentials are NOT stored here. Prosody's mod_turn_external mints
|
||
|
|
# time-limited credentials using the shared secret (see static-auth-secret),
|
||
|
|
# and hands them to clients over XEP-0215. Keep the secret in sync between
|
||
|
|
# this file and TURN_SECRET in .env.
|
||
|
|
|
||
|
|
# Listening sockets. The container runs with network_mode: host, so these
|
||
|
|
# bind directly to the server's public interface.
|
||
|
|
listening-port=3478
|
||
|
|
tls-listening-port=5349
|
||
|
|
|
||
|
|
# Public address advertised in relay candidates. Without this, coturn hands
|
||
|
|
# out its own view of the interface address, which breaks behind any NAT.
|
||
|
|
external-ip=176.124.216.197
|
||
|
|
|
||
|
|
# Relay port range. Each concurrent call leg consumes a port from this range.
|
||
|
|
min-port=49160
|
||
|
|
max-port=49200
|
||
|
|
|
||
|
|
# Authentication: long-term credentials derived from a shared secret
|
||
|
|
# (REST API / TURN time-limited credentials, as used by XEP-0215).
|
||
|
|
use-auth-secret
|
||
|
|
static-auth-secret=e7b94c2d2af838f332a2173a5318a336bdf3cfdb812e5842266d5cd6e6e31d60
|
||
|
|
realm=guschin.info
|
||
|
|
|
||
|
|
# TLS for turns:. Uses the existing multi-SAN guschin.info certificate, which
|
||
|
|
# is why the advertised TURN host is guschin.info and not turn.guschin.info
|
||
|
|
# (the latter is not in the cert's SANs, so TLS validation would fail).
|
||
|
|
cert=/etc/coturn/certs/fullchain.pem
|
||
|
|
pkey=/etc/coturn/certs/privkey.pem
|
||
|
|
|
||
|
|
# Harden: this is a relay for our own users, not an open proxy.
|
||
|
|
# Deny relaying to private ranges so TURN can't be used to reach internal
|
||
|
|
# services (loopback, RFC1918, link-local, CGNAT, multicast).
|
||
|
|
no-multicast-peers
|
||
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
||
|
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
||
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
||
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
||
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
||
|
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
||
|
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
||
|
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
||
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
||
|
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
||
|
|
denied-peer-ip=::1
|
||
|
|
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||
|
|
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||
|
|
|
||
|
|
# No TURN-over-plain-old-CLI admin interface, no SQLite/Redis state.
|
||
|
|
no-cli
|
||
|
|
|
||
|
|
# Disable legacy/weak mechanisms.
|
||
|
|
no-tlsv1
|
||
|
|
no-tlsv1_1
|
||
|
|
|
||
|
|
# Per-user relay caps, to limit the blast radius of a leaked credential.
|
||
|
|
user-quota=12
|
||
|
|
total-quota=1200
|
||
|
|
|
||
|
|
# Logging to stdout so `docker logs coturn` works.
|
||
|
|
log-file=stdout
|
||
|
|
simple-log
|