Stage TLS cert for coturn so turns: works.

coturn drops to nobody, but Let's Encrypt keeps privkey.pem root:root
0600, so it could not read the key and started without TLS listeners --
turns: on 5349 was silently unavailable while STUN/TURN on 3478 worked.

Copy the cert at container start into a directory owned by the runtime
user, the same approach the Prosody entrypoint already uses here, rather
than relaxing permissions on the shared Let's Encrypt tree and exposing
the key to every other container on the host.

The container now starts as root for the copy and coturn drops privileges
itself via proc-user/proc-group. Since the copy happens at start, a
renewal requires a restart, matching the existing Prosody deploy hook.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

coturn/turnserver.conf

@@ -34,8 +34,15 @@ realm=guschin.info
 # TLS for turns:. Uses the existing multi-SAN guschin.info certificate, which
 # is why the advertised TURN host is guschin.info and not turn.guschin.info
 # (the latter is not in the cert's SANs, so TLS validation would fail).
-cert=/etc/letsencrypt/live/guschin.info/fullchain.pem
-pkey=/etc/letsencrypt/live/guschin.info/privkey.pem
+# These are the copies staged by entrypoint.sh, not the Let's Encrypt
+# originals: the real privkey.pem is root-only and coturn runs as nobody.
+cert=/var/lib/coturn/certs/fullchain.pem
+pkey=/var/lib/coturn/certs/privkey.pem
+
+# Drop privileges after binding. The container starts as root only so the
+# entrypoint can stage the certificate.
+proc-user=nobody
+proc-group=nogroup
 
 # Harden: this is a relay for our own users, not an open proxy.
 # Deny relaying to private ranges so TURN can't be used to reach internal