mish/prosody
0
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix coturn TLS listeners and pin relay to public IP.

Browse Source 
Two problems found once coturn was running:

TLS listeners never started. The live/ certificate files are relative
symlinks into ../../archive/, so mounting live/ alone left them dangling
and coturn silently fell back to no TLS, disabling turns: on 5349.
Prosody's identical mount works only because its entrypoint copies the
files; coturn reads them in place. Mount both trees at their real paths
and reference the cert through live/.

Relay used every interface. Without explicit addresses coturn discovered
all of them and offered relay candidates on the Docker bridges and
loopback -- unreachable for remote peers, and needless exposure of the
internal networks. Pin listening-ip and relay-ip to the public address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
mguschin
2026-08-18 22:20:37 +03:00
parent 3fc1ac3d12
commit c11f05481c
3 changed files with 19 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
coturn/turnserver.conf
View File

@@ -10,6 +10,13 @@
listening-port=3478
tls-listening-port=5349
# Pin both the listening and relay addresses to the public interface.
# Without these, coturn auto-discovers every interface and hands out relay
# candidates on the Docker bridges (172.x, 192.168.x) and loopback, which
# remote peers cannot reach and which needlessly expose internal networks.
listening-ip=176.124.216.197
relay-ip=176.124.216.197
# Public address advertised in relay candidates. Without this, coturn hands
# out its own view of the interface address, which breaks behind any NAT.
external-ip=176.124.216.197
@@ -27,8 +34,8 @@ realm=guschin.info
# TLS for turns:. Uses the existing multi-SAN guschin.info certificate, which
# is why the advertised TURN host is guschin.info and not turn.guschin.info
# (the latter is not in the cert's SANs, so TLS validation would fail).
cert=/etc/coturn/certs/fullchain.pem
pkey=/etc/coturn/certs/privkey.pem
cert=/etc/letsencrypt/live/guschin.info/fullchain.pem
pkey=/etc/letsencrypt/live/guschin.info/privkey.pem
# Harden: this is a relay for our own users, not an open proxy.
# Deny relaying to private ranges so TURN can't be used to reach internal