mish/prosody
0
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix coturn TLS listeners and pin relay to public IP.

Browse Source 
Two problems found once coturn was running:

TLS listeners never started. The live/ certificate files are relative
symlinks into ../../archive/, so mounting live/ alone left them dangling
and coturn silently fell back to no TLS, disabling turns: on 5349.
Prosody's identical mount works only because its entrypoint copies the
files; coturn reads them in place. Mount both trees at their real paths
and reference the cert through live/.

Relay used every interface. Without explicit addresses coturn discovered
all of them and offered relay candidates on the Docker bridges and
loopback -- unreachable for remote peers, and needless exposure of the
internal networks. Pin listening-ip and relay-ip to the public address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mguschin
2026-08-18 22:20:37 +03:00
parent 3fc1ac3d12
commit c11f05481c
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@@ -112,9 +112,11 @@ the current cert's SANs. To use `turn.guschin.info` instead, reissue the
certificate with that name added and update both `TURN_HOST` and the
`external-ip`/`cert` settings accordingly.
`external-ip` in `turnserver.conf` is the server's public address. **Update it
if the server IP changes**, otherwise coturn advertises relay candidates that
peers cannot reach.
`turnserver.conf` pins the server's public address in three places:
`listening-ip`, `relay-ip`, and `external-ip`. **Update all three if the
server IP changes**, otherwise coturn advertises relay candidates that peers
cannot reach. Pinning them also stops coturn from auto-discovering the Docker
bridge interfaces and relaying on unreachable private addresses.
### Verifying