feat(coturn): add dedicated web-svc-coturn role with schema, ports, network, and docker-compose template

- registered subnet 192.168.104.48/28 for coturn in group_vars/all/09_networks.yml
- defined public ports for stun/turn and relay port range in group_vars/all/10_ports.yml
- removed obsolete TODO.md and env.j2 from role
- added schema/main.yml with credentials validation (user_password, auth_secret)
- refactored tasks to load sys-stk-back-stateless instead of sys-stk-full-stateful
- implemented docker-compose.yml.j2 with auth-secret + lt-cred-mech and TLS config
- restructured vars/main.yml with docker, ports, credentials, and certificates
- updated config/main.yml.j2 with canonical domain and service definitions

Conversation: https://chatgpt.com/share/68d6c4a8-d524-800f-9592-e8a3407cd721

group_vars/all/09_networks.yml

@@ -110,6 +110,8 @@ defaults_networks:
       subnet: 192.168.104.16/28
     web-app-minio:
       subnet: 192.168.104.32/28
+    web-svc-coturn:
+      subnet: 192.168.104.48/28
 
     # /24 Networks / 254 Usable Clients
     web-app-bigbluebutton:

group_vars/all/10_ports.yml

@@ -84,16 +84,22 @@ ports:
   public:
     # The following ports should be changed to 22 on the subdomain via stream mapping
     ssh:
-      web-app-gitea: 2201
-      web-app-gitlab: 2202
+      web-app-gitea:          2201
+      web-app-gitlab:         2202
     ldaps:
-      svc-db-openldap: 636
+      svc-db-openldap:        636
     stun:
-      web-app-bigbluebutton: 3478    # Not sure if it's right placed here or if it should be moved to localhost section
-      # Occupied by BBB:     3479
-      web-app-nextcloud:     3480
+      web-app-bigbluebutton:  3478  # Not sure if it's right placed here or if it should be moved to localhost section
+      # Occupied by BBB:      3479
+      web-app-nextcloud:      3480
+      web-app-coturn:         3481
     turn:
-      web-app-bigbluebutton: 5349    # Not sure if it's right placed here or if it should be moved to localhost section
-      web-app-nextcloud:     5350        # Not used yet
+      web-app-bigbluebutton:  5349  # Not sure if it's right placed here or if it should be moved to localhost section
+      web-app-nextcloud:      5350  # Not used yet
+      web-app-coturn:         5351
     federation:
       web-app-matrix_synapse: 8448
+    relay_port_ranges:
+      web-app-coturn_start:   49152
+      web-app-coturn_end:     65535
+

roles/web-svc-coturn/TODO.md

@@ -1,2 +0,0 @@
-# Todo
-- Implement this role

roles/web-svc-coturn/config/main.yml.j2

@@ -1,2 +1,13 @@
-user:         turnuser
-credentials:  
+server:
+  domains:
+    canonical:
+      - "coturn.{{ PRIMARY_DOMAIN }}"
+docker:
+  services:
+    coturn:
+      image:    "coturn/coturn"
+      version:  "latest"
+    redis:
+      enabled:  false
+    database: 
+      enabled:  false

roles/web-svc-coturn/schema/main.yml

@@ -0,0 +1,9 @@
+credentials:
+  user_password:
+    description:  "Long-Term Credential password for clients"
+    algorithm:    "alphanumeric_32"
+    validation:   "^[A-Za-z0-9]{32}$"
+  auth_secret:
+    description:  "TURN-REST static auth secret"
+    algorithm:    "sha1"
+    validation:   "^[a-f0-9]{40}$"

roles/web-svc-coturn/tasks/main.yml

@@ -1,4 +1,4 @@
 ---
-- name: "load docker, db and proxy for {{ application_id }}"
+- name: "For '{{ application_id }}': Load sys-stk-back-stateless"
   include_role:
-    name: sys-stk-full-stateful
+    name: sys-stk-back-stateless

roles/web-svc-coturn/templates/docker-compose.yml.j2

@@ -2,44 +2,38 @@
   
   coturn:
 {% include 'roles/docker-container/templates/base.yml.j2' %}
-    image: coturn/coturn
-    restart: always
-    network_mode: "host"
+    image: {{ COTURN_IMAGE }}:{{ COTURN_VERSION }}
+    container_name: {{ COTURN_VOLUME }}
+    {% include 'roles/docker-container/templates/base.yml.j2' %}
     ports:
-      - "3478:3478/udp"
-      - "3478:3478/tcp"
-      - "5349:5349/tcp"
-      - "5349:5349/udp"
-      - "49152-65535:49152-65535/udp"  # TURN-Relay-Ports (wichtig!)
-    #volumes:                         # In case customized config is required
-    #   - coturn-config:/etc/coturn
-    environment:
-      - TURN_PORT=3478
-      - TURN_PORT_TLS=5349
-      - TURN_SECRET=my-secret-key
-      - TURN_USER=turnuser
-      - TURN_PASSWORD=turnpassword
+      - "{{ COTURN_TURN_PORT }}:{{ COTURN_TURN_PORT }}/udp"
+      - "{{ COTURN_TURN_PORT }}:{{ COTURN_TURN_PORT }}/tcp"
+      - "{{ COTURN_STUN_PORT }}:{{ COTURN_STUN_PORT }}/tcp"
+      - "{{ COTURN_STUN_PORT }}:{{ COTURN_STUN_PORT }}/udp"
+      - "{{ COTURN_RELAY_PORT_RANGE }}/udp"
     command: >
-      --log-file=stdout
-      --external-ip=$(detect-external-ip)
+      --use-auth-secret
+      --static-auth-secret={{ COTURN_STATIC_AUTH_SECRET }}
       --lt-cred-mech
-      --user=turnuser:turnpassword
-      --realm=nextcloud
+      --user={{ COTURN_USER_NAME }}:{{ COTURN_USER_PASSWORD }}
+      --log-file=stdout
+      --external-ip={{ networks.internet.ip4 }}
+{% if networks.internet.ip6|default('') %}
+      --external-ip={{ networks.internet.ip6 }}
+{% endif %}
+      --realm={{ COTURN_REALM }}
+      --fingerprint
       --total-quota=100
       --stale-nonce
       --no-multicast-peers
-      --denied-peer-ip=0.0.0.0-0.255.255.255
-      --denied-peer-ip=10.0.0.0-10.255.255.255
-      --denied-peer-ip=100.64.0.0-100.127.255.255
-      --denied-peer-ip=169.254.0.0-169.254.255.255
-      --denied-peer-ip=172.16.0.0-172.31.255.255
-      --denied-peer-ip=192.0.0.0-192.0.0.255
-      --denied-peer-ip=192.88.99.0-192.88.99.255
-      --denied-peer-ip=192.168.0.0-192.168.255.255
-      --denied-peer-ip=198.18.0.0-198.19.255.255
-      --denied-peer-ip=198.51.100.0-198.51.100.255
-      --denied-peer-ip=203.0.113.0-203.0.113.255
-      --denied-peer-ip=240.0.0.0-255.255.255.255
+      --no-cli
+      --no-tcp-relay
+      --min-port={{ COTURN_RELAY_PORT_START }}
+      --max-port={{ COTURN_RELAY_PORT_END }}
+      --cert={{ COTURN_TLS_CERT_PATH }}
+      --pkey={{ COTURN_TLS_KEY_PATH }}
+      --cipher-list=DEFAULT
+      --dh2066
+{% include 'roles/docker-container/templates/networks.yml.j2' %}
 
-{% include 'roles/docker-compose/templates/volumes.yml.j2' %}
-  coturn-config:
+{% include 'roles/docker-compose/templates/networks.yml.j2' %}

roles/web-svc-coturn/vars/main.yml

@@ -1,2 +1,28 @@
-application_id:     "web-svc-coturn"
-container_port:     3000
+# General
+application_id:             "web-svc-coturn"
+entity_name:                "{{ application_id | get_entity_name }}"
+domain:                     "{{ domains | get_domain(application_id) }}"
+
+# Coturn 
+
+## Docker 
+COTURN_VERSION:             "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.version') }}"
+COTURN_IMAGE:               "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.image') }}"
+COTURN_VOLUME:              "{{ entity_name }}"
+COTURN_REALM:               "{{ domain }}"
+
+## Ports
+COTURN_TURN_PORT:           "{{ ports.public.turn[application_id] }}"
+COTURN_STUN_PORT:           "{{ ports.public.stun[application_id] }}"
+COTURN_RELAY_PORT_START:    "{{ ports.public.relay_port_ranges[application_id ~ '_start'] }}"
+COTURN_RELAY_PORT_END:      "{{ ports.public.relay_port_ranges[application_id ~ '_end'  ] }}"
+COTURN_RELAY_PORT_RANGE:    "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_END }}"
+
+## Credentials 
+COTURN_USER_NAME:           "{{ applications | get_app_conf(application_id, 'credentials.user_name') }}"
+COTURN_USER_PASSWORD:       "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}"
+COTURN_STATIC_AUTH_SECRET:  "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}"
+
+## Certificates
+COTURN_TLS_CERT_PATH:       "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}"
+COTURN_TLS_KEY_PATH:        "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'privkey.pem'   ] | path_join }}"