# Screener self-hosted STUN-only configuration.
# Target: coturn 4.17.2 or a newer patched release.
# Copy this file outside the repository and restrict it to the coturn service
# account. No application secret or relay port range is required.

# Ordinary peer ICE uses UDP STUN discovery only. Coturn documents `stun-only`
# as ignoring every TURN request, so this listener cannot allocate media relays.
listening-port=3478
stun-only
no-tcp
no-tls

# Approved NAT survey listeners only. Keep `stun-only` enabled: these auxiliary
# endpoints are for ordinary Binding requests, not TURN media relay. Replace
# <PRIVATE_LISTEN_IP> with the host address already bound by the main listener.
# They use the same public IP and therefore measure destination-port behavior;
# full RFC 5780 behavior discovery still needs a second public IPv4.
#aux-server=<PRIVATE_LISTEN_IP>:3479
#aux-server=<PRIVATE_LISTEN_IP>:3480

# Keep automatic address selection on a single-homed public host. On a
# multi-homed host, bind only the intended public interface.
#listening-ip=<PUBLIC_LISTEN_IP>

fingerprint
no-cli

# Let the service supervisor apply bounded retention. Do not enable verbose or
# log-binding in normal production; STUN logs can contain client IP addresses.
log-file=stdout
log-min-level=info
new-log-timestamp
pidfile=/run/coturn/turnserver.pid