From aecb32b1244a59d5269601a2080e57596655c82a Mon Sep 17 00:00:00 2001 From: mguschin Date: Tue, 18 Aug 2026 22:27:23 +0300 Subject: [PATCH] Document TURN certificate renewal hook. coturn stages the cert at start, so a renewal needs a container restart. Record that the certbot deploy hook (which lives outside this repo) now restarts coturn alongside prosody-xmpp. Co-Authored-By: Claude Opus 5 --- README.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/README.md b/README.md index e897201..566bb1e 100644 --- a/README.md +++ b/README.md @@ -132,6 +132,21 @@ audio/video include Conversations (Android), Dino, Gajim, and Monal (iOS). Note that Jingle A/V is client-to-client — both parties need a client that supports it. +### Certificate renewal + +`coturn/entrypoint.sh` copies the certificate at container start, because +coturn runs as `nobody` and cannot read Let's Encrypt's root-only +`privkey.pem` directly. A renewal therefore needs a container restart, which +the certbot deploy hook on the server handles (outside this repo): + +``` +/etc/letsencrypt/renewal-hooks/deploy/restart-prosody.sh +``` + +It restarts both `prosody-xmpp` and `coturn` when the `guschin.info` or +`xmpp.guschin.info` lineage is renewed. Without the coturn restart, `turns:` +on 5349 would keep serving the old certificate until the next restart. + ### Firewall Ports 3478 and 5349 (both UDP and TCP) plus the UDP relay range 49160-49200