coturn stages the cert at start, so a renewal needs a container restart.
Record that the certbot deploy hook (which lives outside this repo) now
restarts coturn alongside prosody-xmpp.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two problems found once coturn was running:
TLS listeners never started. The live/ certificate files are relative
symlinks into ../../archive/, so mounting live/ alone left them dangling
and coturn silently fell back to no TLS, disabling turns: on 5349.
Prosody's identical mount works only because its entrypoint copies the
files; coturn reads them in place. Mount both trees at their real paths
and reference the cert through live/.
Relay used every interface. Without explicit addresses coturn discovered
all of them and offered relay candidates on the Docker bridges and
loopback -- unreachable for remote peers, and needless exposure of the
internal networks. Pin listening-ip and relay-ip to the public address.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jingle A/V (XEP-0166/0167/0176) needs a STUN/TURN server for NAT
traversal. Add coturn and advertise it to clients via XEP-0215.
- coturn container, host networking (a relay needs its full UDP port
range reachable, and Docker NAT hides the peer addresses coturn needs).
- mod_turn_external in Prosody to advertise the service and mint
time-limited credentials from a shared secret.
- Advertise UDP and TCP transports plus turns: on 5349, so clients on
UDP-blocking networks can still connect.
- Deny relaying to private ranges, so this is not an open proxy into
internal services.
TURN host is guschin.info rather than turn.guschin.info because only the
former is in the certificate SANs and turns: clients validate the name.
TURN_HOST/TURN_SECRET go in .env, which is gitignored and set per
deployment; TURN_SECRET must match static-auth-secret in turnserver.conf.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
