From 3d2f432619f6f7fa6ac9065b46333b812d01b507 Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Mon, 13 Jul 2026 01:19:55 +0300
Subject: [PATCH] heather: add coturn TURN relay for jitsi (clients behind
 symmetric NAT)

- coturn/coturn:4.7 in host network (real client IPs, NAT traversal)
- static-auth-secret shared with jitsi-web TURN_CREDENTIALS (in jitsi.env)
- RTP relay 49152-65535/udp, listening-port 3478
- realm turn.iscg.dev, external-ip 51.250.45.111
- no-tls/no-dtls (TLS on 5349 disabled, udp-only for now)
- jitsi-web env: TURN_HOST/PORT/TRANSPORT
- NixOS firewall: 3478 tcp+udp, 49152-65535/udp range
- YC SG already has 3478/5349/49152-65535 from initial setup
---
 hosts/heather/arion-compose.nix | 19 +++++++++++++++++++
 hosts/heather/default.nix       |  6 ++++++
 2 files changed, 25 insertions(+)

diff --git a/hosts/heather/arion-compose.nix b/hosts/heather/arion-compose.nix
index e82042d..f9b8acb 100644
--- a/hosts/heather/arion-compose.nix
+++ b/hosts/heather/arion-compose.nix
@@ -179,6 +179,10 @@
         AUTH_TYPE = "internal";
         ENABLE_XMPP_WEBSOCKET = "1";
         ENABLE_COLIBRI_WEBSOCKET = "1";
+        # TURN (coturn) — relay for clients behind symmetric NAT
+        TURN_HOST = "51.250.45.111";
+        TURN_PORT = "3478";
+        TURN_TRANSPORT = "udp";
       };
     };
 
@@ -240,6 +244,21 @@
       };
     };
 
+    # === Coturn (TURN relay for jitsi) ===
+    # Host network: real client IPs + correct NAT traversal. No port conflicts
+    # on heather (no system coturn). Relays RTP on 49152-65535/udp.
+    # YC SG already has 3478/5349/49152-65535 open. Secret TURN_STATIC_AUTH_SECRET
+    # in jitsi.env (shared with jitsi-web via TURN_CREDENTIALS).
+    # Docs: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#turn-server-configuration
+    jitsi-coturn = {
+      service.image = "coturn/coturn:4.7";
+      service.container_name = "jitsi-coturn";
+      service.restart = "unless-stopped";
+      service.network_mode = "host";
+      service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
+      service.command = "-v --log-file=stdout --realm=turn.iscg.dev --external-ip=51.250.45.111 --use-auth-secret --static-auth-secret=$${TURN_STATIC_AUTH_SECRET} --min-port=49152 --max-port=65535 --listening-port=3478 --no-tls --no-dtls --fingerprint --no-cli --simple-log";
+    };
+
     # === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount ===
     # Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства).
     # Единственный сервис без named volume — по твоему решению, чтобы notes
diff --git a/hosts/heather/default.nix b/hosts/heather/default.nix
index 818ff3f..0f12bf2 100644
--- a/hosts/heather/default.nix
+++ b/hosts/heather/default.nix
@@ -43,10 +43,16 @@
       22000   # syncthing sync
       22067   # strelaysrv (relay)
       22070   # strelaysrv (status)
+      3478    # coturn TURN (tcp+udp)
     ];
     firewall.allowedUDPPorts = [
       22000   # syncthing sync (QUIC)
       10000   # jitsi jvb (RTP media)
+      3478    # coturn TURN
+    ];
+    # coturn RTP relay range
+    firewall.allowedUDPPortRanges = [
+      { from = 49152; to = 65535; }  # coturn RTP relay
     ];
   };
   # useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.