mish/prosody
0
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Document TURN certificate renewal hook.

Browse Source 
coturn stages the cert at start, so a renewal needs a container restart.
Record that the certbot deploy hook (which lives outside this repo) now
restarts coturn alongside prosody-xmpp.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mguschin
2026-08-18 22:27:23 +03:00
parent bf8f50ea72
commit aecb32b124
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
README.md
View File

@@ -132,6 +132,21 @@ audio/video include Conversations (Android), Dino, Gajim, and Monal (iOS).
Note that Jingle A/V is client-to-client — both parties need a client that Note that Jingle A/V is client-to-client — both parties need a client that
supports it. supports it.
### Certificate renewal
`coturn/entrypoint.sh` copies the certificate at container start, because
coturn runs as `nobody` and cannot read Let's Encrypt's root-only
`privkey.pem` directly. A renewal therefore needs a container restart, which
the certbot deploy hook on the server handles (outside this repo):
```
/etc/letsencrypt/renewal-hooks/deploy/restart-prosody.sh
```
It restarts both `prosody-xmpp` and `coturn` when the `guschin.info` or
`xmpp.guschin.info` lineage is renewed. Without the coturn restart, `turns:`
on 5349 would keep serving the old certificate until the next restart.
### Firewall ### Firewall
Ports 3478 and 5349 (both UDP and TCP) plus the UDP relay range 49160-49200 Ports 3478 and 5349 (both UDP and TCP) plus the UDP relay range 49160-49200