70 lines
2.5 KiB
Plaintext
70 lines
2.5 KiB
Plaintext
# Tera coturn template. Copy to /etc/turnserver.conf only after replacing every
|
|
# REQUIRED_* value and completing the operator review in README.md.
|
|
|
|
listening-port=3478
|
|
tls-listening-port=5349
|
|
|
|
# Oracle assigns the public address through one-to-one NAT. Coturn must bind the
|
|
# VNIC address while advertising the port-preserving public/private mapping.
|
|
listening-ip=REQUIRED_PRIVATE_IPV4
|
|
relay-ip=REQUIRED_PRIVATE_IPV4
|
|
external-ip=REQUIRED_PUBLIC_IPV4/REQUIRED_PRIVATE_IPV4
|
|
|
|
realm=turn.lumbridgecorp.com
|
|
server-name=turn.lumbridgecorp.com
|
|
fingerprint
|
|
|
|
# Tera's authenticated ICE endpoint and coturn hold the same random secret.
|
|
# Do not enable both lt-cred-mech and use-auth-secret; the latter is coturn's
|
|
# time-limited TURN REST authentication mode.
|
|
use-auth-secret
|
|
static-auth-secret=REQUIRED_RANDOM_64_HEX_SECRET
|
|
stale-nonce
|
|
|
|
cert=/etc/coturn/certs/turn.fullchain.pem
|
|
pkey=/etc/coturn/certs/turn.privkey.pem
|
|
|
|
# Dedicated to Tera. Do not overlap the retired LiveKit 50000-50200 range.
|
|
min-port=52000
|
|
max-port=53023
|
|
|
|
# One credential may briefly own several allocations during ICE restart. The
|
|
# total stays below the 1,024-port relay range; tune only from observed usage.
|
|
user-quota=4
|
|
total-quota=900
|
|
max-bps=2000000
|
|
bps-capacity=500000000
|
|
|
|
# Browser media uses UDP relay endpoints even when its connection to coturn is
|
|
# TCP/TLS. Disabling RFC 6062 TCP peer relays reduces proxy-abuse surface.
|
|
no-tcp-relay
|
|
no-dtls
|
|
no-multicast-peers
|
|
no-cli
|
|
no-software-attribute
|
|
|
|
# Never turn the public relay into a route to local, cloud metadata, Docker,
|
|
# Tailscale/CGNAT, documentation, multicast, or reserved networks. Coturn uses
|
|
# inclusive address ranges here, not CIDR notation.
|
|
denied-peer-ip=0.0.0.0-0.255.255.255
|
|
denied-peer-ip=10.0.0.0-10.255.255.255
|
|
denied-peer-ip=100.64.0.0-100.127.255.255
|
|
denied-peer-ip=127.0.0.0-127.255.255.255
|
|
denied-peer-ip=169.254.0.0-169.254.255.255
|
|
denied-peer-ip=172.16.0.0-172.31.255.255
|
|
denied-peer-ip=192.0.0.0-192.0.0.255
|
|
denied-peer-ip=192.0.2.0-192.0.2.255
|
|
denied-peer-ip=192.168.0.0-192.168.255.255
|
|
denied-peer-ip=198.18.0.0-198.19.255.255
|
|
denied-peer-ip=198.51.100.0-198.51.100.255
|
|
denied-peer-ip=203.0.113.0-203.0.113.255
|
|
denied-peer-ip=224.0.0.0-255.255.255.255
|
|
denied-peer-ip=::1-::1
|
|
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
denied-peer-ip=ff00::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
|
|
|
# Binding-request logging is intentionally left disabled. Keep logs in the
|
|
# journal/syslog and never add credentials or full SDP to application logs.
|
|
syslog
|