3fc1ac3d12
Jingle A/V (XEP-0166/0167/0176) needs a STUN/TURN server for NAT traversal. Add coturn and advertise it to clients via XEP-0215. - coturn container, host networking (a relay needs its full UDP port range reachable, and Docker NAT hides the peer addresses coturn needs). - mod_turn_external in Prosody to advertise the service and mint time-limited credentials from a shared secret. - Advertise UDP and TCP transports plus turns: on 5349, so clients on UDP-blocking networks can still connect. - Deny relaying to private ranges, so this is not an open proxy into internal services. TURN host is guschin.info rather than turn.guschin.info because only the former is in the certificate SANs and turns: clients validate the name. TURN_HOST/TURN_SECRET go in .env, which is gitignored and set per deployment; TURN_SECRET must match static-auth-secret in turnserver.conf. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
65 lines
2.4 KiB
Plaintext
65 lines
2.4 KiB
Plaintext
# coturn TURN/STUN server for XMPP Jingle audio/video calls
|
|
#
|
|
# Credentials are NOT stored here. Prosody's mod_turn_external mints
|
|
# time-limited credentials using the shared secret (see static-auth-secret),
|
|
# and hands them to clients over XEP-0215. Keep the secret in sync between
|
|
# this file and TURN_SECRET in .env.
|
|
|
|
# Listening sockets. The container runs with network_mode: host, so these
|
|
# bind directly to the server's public interface.
|
|
listening-port=3478
|
|
tls-listening-port=5349
|
|
|
|
# Public address advertised in relay candidates. Without this, coturn hands
|
|
# out its own view of the interface address, which breaks behind any NAT.
|
|
external-ip=176.124.216.197
|
|
|
|
# Relay port range. Each concurrent call leg consumes a port from this range.
|
|
min-port=49160
|
|
max-port=49200
|
|
|
|
# Authentication: long-term credentials derived from a shared secret
|
|
# (REST API / TURN time-limited credentials, as used by XEP-0215).
|
|
use-auth-secret
|
|
static-auth-secret=e7b94c2d2af838f332a2173a5318a336bdf3cfdb812e5842266d5cd6e6e31d60
|
|
realm=guschin.info
|
|
|
|
# TLS for turns:. Uses the existing multi-SAN guschin.info certificate, which
|
|
# is why the advertised TURN host is guschin.info and not turn.guschin.info
|
|
# (the latter is not in the cert's SANs, so TLS validation would fail).
|
|
cert=/etc/coturn/certs/fullchain.pem
|
|
pkey=/etc/coturn/certs/privkey.pem
|
|
|
|
# Harden: this is a relay for our own users, not an open proxy.
|
|
# Deny relaying to private ranges so TURN can't be used to reach internal
|
|
# services (loopback, RFC1918, link-local, CGNAT, multicast).
|
|
no-multicast-peers
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
denied-peer-ip=240.0.0.0-255.255.255.255
|
|
denied-peer-ip=::1
|
|
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
|
|
# No TURN-over-plain-old-CLI admin interface, no SQLite/Redis state.
|
|
no-cli
|
|
|
|
# Disable legacy/weak mechanisms.
|
|
no-tlsv1
|
|
no-tlsv1_1
|
|
|
|
# Per-user relay caps, to limit the blast radius of a leaked credential.
|
|
user-quota=12
|
|
total-quota=1200
|
|
|
|
# Logging to stdout so `docker logs coturn` works.
|
|
log-file=stdout
|
|
simple-log
|