mguschin bf8f50ea72 Stage TLS cert for coturn so turns: works. ...

coturn drops to nobody, but Let's Encrypt keeps privkey.pem root:root
0600, so it could not read the key and started without TLS listeners --
turns: on 5349 was silently unavailable while STUN/TURN on 3478 worked.

Copy the cert at container start into a directory owned by the runtime
user, the same approach the Prosody entrypoint already uses here, rather
than relaxing permissions on the shared Let's Encrypt tree and exposing
the key to every other container on the host.

The container now starts as root for the copy and coturn drops privileges
itself via proc-user/proc-group. Since the copy happens at start, a
renewal requires a restart, matching the existing Prosody deploy hook.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-18 22:21:57 +03:00

3.0 KiB

Raw Blame History

View Raw