diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix
index e82042d..f9b8acb 100644
--- a/hosts/heather/arion-compose.nix
+++ b/hosts/heather/arion-compose.nix
@@ -179,6 +179,10 @@
         AUTH_TYPE = "internal";
         ENABLE_XMPP_WEBSOCKET = "1";
         ENABLE_COLIBRI_WEBSOCKET = "1";
+        # TURN (coturn) — relay for clients behind symmetric NAT
+        TURN_HOST = "51.250.45.111";
+        TURN_PORT = "3478";
+        TURN_TRANSPORT = "udp";
       };
     };
 
@@ -240,6 +244,21 @@
       };
     };
 
+    # === Coturn (TURN relay for jitsi) ===
+    # Host network: real client IPs + correct NAT traversal. No port conflicts
+    # on heather (no system coturn). Relays RTP on 49152-65535/udp.
+    # YC SG already has 3478/5349/49152-65535 open. Secret TURN_STATIC_AUTH_SECRET
+    # in jitsi.env (shared with jitsi-web via TURN_CREDENTIALS).
+    # Docs: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#turn-server-configuration
+    jitsi-coturn = {
+      service.image = "coturn/coturn:4.7";
+      service.container_name = "jitsi-coturn";
+      service.restart = "unless-stopped";
+      service.network_mode = "host";
+      service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
+      service.command = "-v --log-file=stdout --realm=turn.iscg.dev --external-ip=51.250.45.111 --use-auth-secret --static-auth-secret=$${TURN_STATIC_AUTH_SECRET} --min-port=49152 --max-port=65535 --listening-port=3478 --no-tls --no-dtls --fingerprint --no-cli --simple-log";
+    };
+
     # === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount ===
     # Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства).
     # Единственный сервис без named volume — по твоему решению, чтобы notes
diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix
index 818ff3f..0f12bf2 100644
--- a/hosts/heather/default.nix
+++ b/hosts/heather/default.nix
@@ -43,10 +43,16 @@
       22000   # syncthing sync
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
+      3478    # coturn TURN (tcp+udp)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)
       10000   # jitsi jvb (RTP media)
+      3478    # coturn TURN
+    ];
+    # coturn RTP relay range
+    firewall.allowedUDPPortRanges = [
+      { from = 49152; to = 65535; }  # coturn RTP relay
     ];
   };
   # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.