COTURN_USER_NAME came from a bare config string, services.coturn.username, and
COTURN_USER_PASSWORD from a role credential named user_password. Neither says
what the account is. compose.yml.j2 shows it: with user_auth_enabled the
turnserver runs --lt-cred-mech --user="name:password", a Long-Term Credential
that WebRTC clients present to be allowed to relay media. That is a machine
account, so declare it as one.
meta/users.yml now holds coturnconsumer with accounts: [], the shape
roles/user/meta/users.yml already uses for root, daemon, bin and sys, and the
same shape the reservation logic auto-creates for role names. No mailbox, no
identity, no host login - an account that exists to carry credentials.
The secret moves with it. users_generator.py pins a vaulted password into the
inventory at users.<name>.password for every user of the resolved role set that
has none, and get_merged_users overlays those inventory values over the role
declaration, so lookup(users, coturnconsumer).password is generated once and
stable across runs. A user may declare password: as a policy dict
(algorithm, validation) when the application demands a shape; a TURN credential
does not, so none is declared. secrets.credentials.user_password is therefore
unread and leaves meta/secrets.yml, and services.coturn.username leaves
meta/services.yml.
auth_secret is untouched. It drives the other, mutually exclusive branch
(--use-auth-secret), which is the one this deployment actually uses:
user_auth_enabled is false in the only place it is set and true nowhere, and
web-app-matrix and web-app-socialhome consume auth_secret alone.
Existing inventories keep an orphaned secrets.credentials.user_password. The
credentials generator is purely additive and never prunes, so it stays and is
read by nothing.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
meta/schema.yml held credential definitions and their runtime values, but the
name said 'schema' and read like structural metadata next to services.yml and
volumes.yml. Nothing in the file is a schema in the sense the other meta files
use the word, and a contributor had to open it to learn it holds secrets.
62 role files renamed. ROLE_FILE_META_SCHEMA becomes ROLE_FILE_META_SECRETS and
keeps its role as the SPOT the path is built from.
Two readers bypassed that constant and spelled the name themselves:
utils/cache/applications.py built meta_dir / 'schema.yml' twice, and
plugins/lookup/application_gid.py carries the filename in the marker list it
detects application roles by. Left behind, the rename would not have raised —
credentials would have resolved empty and the role would have stopped counting
as an application.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5