AAA
38eeadd284
* feat: simplify site access and room joining * docs: update access and room capacity design
75 lines
3.1 KiB
Plaintext
75 lines
3.1 KiB
Plaintext
# Screener minimal production coturn configuration.
|
|
# Target: coturn 4.17.2 or newer patched release.
|
|
# Copy this file outside the repository, replace every <...> placeholder, and
|
|
# restrict the resulting file to the coturn service account.
|
|
|
|
# Required client-facing TURN/STUN listeners.
|
|
listening-port=3478
|
|
|
|
# TURN/TLS is optional. The minimal deployment keeps it disabled and needs no
|
|
# TURN certificate. To enable TLS over TCP, remove `no-tls`, uncomment the
|
|
# standard 5349 listener and certificate paths near the end of this file, then
|
|
# append turns:<TURN_FQDN>:5349?transport=tcp to the application's TURN_URLS.
|
|
no-tls
|
|
#tls-listening-port=5349
|
|
|
|
# Keep the automatic address selection on a single-homed public host. For a
|
|
# multi-homed host or a host behind 1:1 NAT, uncomment and replace these values.
|
|
# The NAT must preserve every relay port (external port equals internal port).
|
|
#listening-ip=<LOCAL_LISTEN_IP>
|
|
#relay-ip=<LOCAL_RELAY_IP>
|
|
#external-ip=<PUBLIC_IP>/<LOCAL_RELAY_IP>
|
|
|
|
# A deliberately small relay range for the friend-group PoC. Open the entire
|
|
# range bidirectionally for UDP and monitor allocation failures before changing it.
|
|
min-port=49152
|
|
max-port=49251
|
|
|
|
fingerprint
|
|
realm=<TURN_FQDN>
|
|
server-name=<TURN_FQDN>
|
|
|
|
# TURN REST API credentials. This value must exactly match TURN_SHARED_SECRET
|
|
# in the application environment. Never use a static user/password or no-auth.
|
|
use-auth-secret
|
|
static-auth-secret=<REPLACE_WITH_RANDOM_UNTRACKED_SECRET>
|
|
# Some packaged builds still consult SQLite after reading the shared secret.
|
|
# Keep that optional database writable and ephemeral under RuntimeDirectory.
|
|
userdb=/run/coturn/turndb
|
|
stale-nonce=600
|
|
max-allocate-lifetime=3600
|
|
|
|
# Initial abuse controls. max-bps and bps-capacity use bytes per second, not bits.
|
|
# 2,000,000 bytes/s permits roughly 16 Mbit/s in each direction per allocation.
|
|
# The per-user quota leaves room for the host's independent peer connections
|
|
# and overlapping ICE restarts; it is not a verified media capacity.
|
|
user-quota=32
|
|
total-quota=100
|
|
max-bps=2000000
|
|
|
|
# Do not enable allow-loopback-peers: coturn 4.17.2 denies loopback by default.
|
|
# Prevent a TURN allocation from reaching common private or link-local targets.
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
no-multicast-peers
|
|
|
|
# A certificate for TURN_FQDN is required only by turns: URLs. Use absolute
|
|
# paths in the deployed copy and reload/restart coturn after renewal.
|
|
#cert=<ABSOLUTE_PATH_TO_FULLCHAIN_PEM>
|
|
#pkey=<ABSOLUTE_PATH_TO_PRIVATE_KEY_PEM>
|
|
|
|
# Let the service supervisor apply bounded retention. Do not enable verbose or
|
|
# log-binding in normal production operation; coturn logs can contain client IPs.
|
|
log-file=stdout
|
|
log-min-level=info
|
|
new-log-timestamp
|
|
pidfile=/run/coturn/turnserver.pid
|