feat: stream private office screens

deploy/coturn/certbot-deploy-hook

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Certbot deploy hook: install only the renewed turn certificate, then ask the
+# distro unit to reload or restart. A restart can interrupt active allocations;
+# schedule renewal windows and verify the unit's ExecReload before production.
+set -eu
+
+: "${RENEWED_LINEAGE:?certbot did not provide RENEWED_LINEAGE}"
+openssl x509 -in "$RENEWED_LINEAGE/fullchain.pem" -noout \
+  -checkhost turn.lumbridgecorp.com >/dev/null 2>&1 || exit 0
+getent group turnserver >/dev/null || {
+  echo "coturn certificate hook: turnserver group does not exist" >&2
+  exit 1
+}
+
+install -d -o root -g turnserver -m 0750 /etc/coturn/certs
+install -o root -g turnserver -m 0644 "$RENEWED_LINEAGE/fullchain.pem" /etc/coturn/certs/turn.fullchain.pem
+install -o root -g turnserver -m 0640 "$RENEWED_LINEAGE/privkey.pem" /etc/coturn/certs/turn.privkey.pem
+systemctl try-reload-or-restart coturn.service