mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
f66e76da08
COTURN_USER_NAME came from a bare config string, services.coturn.username, and COTURN_USER_PASSWORD from a role credential named user_password. Neither says what the account is. compose.yml.j2 shows it: with user_auth_enabled the turnserver runs --lt-cred-mech --user="name:password", a Long-Term Credential that WebRTC clients present to be allowed to relay media. That is a machine account, so declare it as one. meta/users.yml now holds coturnconsumer with accounts: [], the shape roles/user/meta/users.yml already uses for root, daemon, bin and sys, and the same shape the reservation logic auto-creates for role names. No mailbox, no identity, no host login - an account that exists to carry credentials. The secret moves with it. users_generator.py pins a vaulted password into the inventory at users.<name>.password for every user of the resolved role set that has none, and get_merged_users overlays those inventory values over the role declaration, so lookup(users, coturnconsumer).password is generated once and stable across runs. A user may declare password: as a policy dict (algorithm, validation) when the application demands a shape; a TURN credential does not, so none is declared. secrets.credentials.user_password is therefore unread and leaves meta/secrets.yml, and services.coturn.username leaves meta/services.yml. auth_secret is untouched. It drives the other, mutually exclusive branch (--use-auth-secret), which is the one this deployment actually uses: user_auth_enabled is false in the only place it is set and true nowhere, and web-app-matrix and web-app-socialhome consume auth_secret alone. Existing inventories keep an orphaned secrets.credentials.user_password. The credentials generator is purely additive and never prunes, so it stays and is read by nothing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
6 lines
149 B
YAML
6 lines
149 B
YAML
---
|
|
coturnconsumer:
|
|
description: Long-Term Credential account a TURN client authenticates the relay with
|
|
username: coturnconsumer
|
|
accounts: []
|