# Tera coturn template. Copy to /etc/turnserver.conf only after replacing every
# REQUIRED_* value and completing the operator review in README.md.

listening-port=3478
tls-listening-port=5349

# Oracle assigns the public address through one-to-one NAT. Coturn must bind the
# VNIC address while advertising the port-preserving public/private mapping.
listening-ip=REQUIRED_PRIVATE_IPV4
relay-ip=REQUIRED_PRIVATE_IPV4
external-ip=REQUIRED_PUBLIC_IPV4/REQUIRED_PRIVATE_IPV4

realm=turn.lumbridgecorp.com
server-name=turn.lumbridgecorp.com
fingerprint

# Tera's authenticated ICE endpoint and coturn hold the same random secret.
# Do not enable both lt-cred-mech and use-auth-secret; the latter is coturn's
# time-limited TURN REST authentication mode.
use-auth-secret
static-auth-secret=REQUIRED_RANDOM_64_HEX_SECRET
stale-nonce

cert=/etc/coturn/certs/turn.fullchain.pem
pkey=/etc/coturn/certs/turn.privkey.pem

# Dedicated to Tera. Do not overlap the retired LiveKit 50000-50200 range.
min-port=52000
max-port=53023

# One credential may briefly own several allocations during ICE restart. The
# total stays below the 1,024-port relay range; tune only from observed usage.
user-quota=4
total-quota=900
max-bps=2000000
bps-capacity=500000000

# Browser media uses UDP relay endpoints even when its connection to coturn is
# TCP/TLS. Disabling RFC 6062 TCP peer relays reduces proxy-abuse surface.
no-tcp-relay
no-dtls
no-multicast-peers
no-cli
no-software-attribute

# Never turn the public relay into a route to local, cloud metadata, Docker,
# Tailscale/CGNAT, documentation, multicast, or reserved networks. Coturn uses
# inclusive address ranges here, not CIDR notation.
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=224.0.0.0-255.255.255.255
denied-peer-ip=::1-::1
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=ff00::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff

# Binding-request logging is intentionally left disabled. Keep logs in the
# journal/syslog and never add credentials or full SDP to application logs.
syslog