kevinveenbirkenbach/computer-playbook
1
0
Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2025-10-10 10:48:10 +02:00
Code Issues Packages Projects Releases Wiki Activity

Refactor TURN/STUN config:

Browse Source 
- Removed ?transport=udp from Nextcloud Talk TURN server definitions
- Dropped --no-tcp-relay to allow TCP fallback
- Removed invalid UDP mapping on TLS port
- Introduced switch between REST secret auth and lt-cred-mech via COTURN_USER_AUTH_ENABLED
- Added user_auth_enabled flag in coturn config for flexibility

See: https://chatgpt.com/share/68d7d601-3558-800f-bc84-00d7e8fc3243
This commit is contained in:
Kevin Veen-Birkenbach
2025-09-27 14:18:29 +02:00
parent eb3bf543a4
commit dbbb3510f3
5 changed files with 18 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
roles/web-app-bigbluebutton/templates/docker-compose.override.yml.j2
View File

@@ -21,7 +21,6 @@ services:
--fingerprint --fingerprint
--no-multicast-peers --no-multicast-peers
--no-cli --no-cli
--no-tcp-relay
--min-port={{ BBB_RELAY_PORT_START }} --min-port={{ BBB_RELAY_PORT_START }}
--max-port={{ BBB_RELAY_PORT_END }} --max-port={{ BBB_RELAY_PORT_END }}
--external-ip=${EXTERNAL_IPv4} --external-ip=${EXTERNAL_IPv4}

4
roles/web-app-nextcloud/vars/main.yml
View File

@@ -85,7 +85,7 @@ NEXTCLOUD_TALK_STUN_ONBOARD_CONFIG: "{{ NEXTCLOUD_TALK_DOMAIN }}:{{ NE
NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG: >- NEXTCLOUD_TALK_TURN_ONBOARD_CONFIG: >-
{{ {{
{ {
'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_ONBOARD_PORT ~ '?transport=udp', 'server': NEXTCLOUD_TALK_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_ONBOARD_PORT,
'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET, 'secret': NEXTCLOUD_TALK_TURN_ONBOARD_SECRET,
'ttl': 86400, 'ttl': 86400,
'protocols': 'udp,tcp' 'protocols': 'udp,tcp'
@@ -102,7 +102,7 @@ NEXTCLOUD_TALK_STUN_STANDALONE_CONFIG: "{{ NEXTCLOUD_TALK_TURN_STANDALONE
NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG: >- NEXTCLOUD_TALK_TURN_STANDALONE_CONFIG: >-
{{ {{
{ {
'server': NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_STANDALONE_PORT ~ '?transport=udp', 'server': NEXTCLOUD_TALK_TURN_STANDALONE_DOMAIN ~ ':' ~ NEXTCLOUD_TALK_TURN_STANDALONE_PORT,
'secret': NEXTCLOUD_TALK_TURN_STANDALONE_SECRET, 'secret': NEXTCLOUD_TALK_TURN_STANDALONE_SECRET,
'ttl': 86400, 'ttl': 86400,
'protocols': 'udp,tcp' 'protocols': 'udp,tcp'

19
roles/web-svc-coturn/config/main.yml
View File

@@ -6,14 +6,15 @@ server:
docker: docker:
services: services:
coturn: coturn:
image: "coturn/coturn" image: "coturn/coturn"
version: "latest" version: "latest"
cpus: 1.0 user_auth_enabled: false
mem_reservation: 512m cpus: 1.0
mem_limit: 1g mem_reservation: 512m
pids_limit: 256 mem_limit: 1g
network_mode: host pids_limit: 256
network_mode: host
redis: redis:
enabled: false enabled: false
database: database:
enabled: false enabled: false

9
roles/web-svc-coturn/templates/docker-compose.yml.j2
View File

@@ -10,7 +10,6 @@
- "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/udp" - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/udp"
- "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/tcp" - "{{ COTURN_STUN_TURN_PORT }}:{{ COTURN_STUN_TURN_PORT }}/tcp"
- "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/tcp" - "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/tcp"
- "{{ COTURN_STUN_TURN_PORT_TLS }}:{{ COTURN_STUN_TURN_PORT_TLS }}/udp"
- "{{ COTURN_RELAY_PORT_RANGE }}/udp" - "{{ COTURN_RELAY_PORT_RANGE }}/udp"
{% include 'roles/docker-container/templates/networks.yml.j2' %} {% include 'roles/docker-container/templates/networks.yml.j2' %}
{% endif %} {% endif %}
@@ -18,10 +17,13 @@
- "{{ COTURN_TLS_CERT_PATH }}:{{ COTURN_TLS_CERT_PATH }}:ro" - "{{ COTURN_TLS_CERT_PATH }}:{{ COTURN_TLS_CERT_PATH }}:ro"
- "{{ COTURN_TLS_KEY_PATH }}:{{ COTURN_TLS_KEY_PATH }}:ro" - "{{ COTURN_TLS_KEY_PATH }}:{{ COTURN_TLS_KEY_PATH }}:ro"
command: > command: >
--use-auth-secret {% if COTURN_USER_AUTH_ENABLED | bool %}
--static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
--lt-cred-mech --lt-cred-mech
--user="${COTURN_USER_NAME}:${COTURN_USER_PASSWORD}" --user="${COTURN_USER_NAME}:${COTURN_USER_PASSWORD}"
{% else %}
--use-auth-secret
--static-auth-secret="${COTURN_STATIC_AUTH_SECRET}"
{% endif %}
--log-file=stdout --log-file=stdout
--external-ip={{ networks.internet.ip4 }} --external-ip={{ networks.internet.ip4 }}
{% if networks.internet.ip6|default('') %} {% if networks.internet.ip6|default('') %}
@@ -33,7 +35,6 @@
--stale-nonce --stale-nonce
--no-multicast-peers --no-multicast-peers
--no-cli --no-cli
--no-tcp-relay
--listening-port={{ COTURN_STUN_TURN_PORT }} --listening-port={{ COTURN_STUN_TURN_PORT }}
--tls-listening-port={{ COTURN_STUN_TURN_PORT_TLS }} --tls-listening-port={{ COTURN_STUN_TURN_PORT_TLS }}
--min-port={{ COTURN_RELAY_PORT_START }} --min-port={{ COTURN_RELAY_PORT_START }}

1
roles/web-svc-coturn/vars/main.yml
View File

@@ -23,6 +23,7 @@ COTURN_RELAY_PORT_RANGE: "{{ COTURN_RELAY_PORT_START }}-{{ COTURN_RELAY_PORT_
COTURN_USER_NAME: "{{ applications | get_app_conf(application_id, 'username') }}" COTURN_USER_NAME: "{{ applications | get_app_conf(application_id, 'username') }}"
COTURN_USER_PASSWORD: "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}" COTURN_USER_PASSWORD: "{{ applications | get_app_conf(application_id, 'credentials.user_password') }}"
COTURN_STATIC_AUTH_SECRET: "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}" COTURN_STATIC_AUTH_SECRET: "{{ applications | get_app_conf(application_id, 'credentials.auth_secret') }}"
COTURN_USER_AUTH_ENABLED: "{{ applications | get_app_conf(application_id, 'docker.services.' ~ entity_name ~ '.user_auth_enabled') }}"
## Certificates ## Certificates
COTURN_TLS_CERT_PATH: "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}" COTURN_TLS_CERT_PATH: "{{ [ LETSENCRYPT_LIVE_PATH, ssl_cert_folder, 'fullchain.pem' ] | path_join }}"