security: bind TURN grants to screen sessions

2026-08-11 21:48:11 -07:00
parent 5ca214e4bb
commit 19f022f71a
16 changed files with 530 additions and 93 deletions
@@ -28,10 +28,14 @@ pkey=/etc/coturn/certs/turn.privkey.pem
 min-port=52000
 max-port=53023

-# One credential may briefly own several allocations during ICE restart. The
-# total stays below the 1,024-port relay range; tune only from observed usage.
+# Coturn keys user-quota by the REST username suffix after the expiry separator.
+# The Tera issuer must reuse one opaque participant-scoped accounting suffix
+# across that participant's credential renewals; a fresh suffix per request would
+# evade this limit. The total stays below the 1,024-port relay range.
 user-quota=4
 total-quota=900
+# Bytes per second, not bits. 500,000,000 B/s is about 4 Gbit/s; lower both
+# global limits to an operator-approved NIC and egress-cost budget before launch.
 max-bps=2000000
 bps-capacity=500000000