mikl/nix-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

heather: add coturn TURN relay for jitsi (clients behind symmetric NAT)

Browse source 
- coturn/coturn:4.7 in host network (real client IPs, NAT traversal)
- static-auth-secret shared with jitsi-web TURN_CREDENTIALS (in jitsi.env)
- RTP relay 49152-65535/udp, listening-port 3478
- realm turn.iscg.dev, external-ip 51.250.45.111
- no-tls/no-dtls (TLS on 5349 disabled, udp-only for now)
- jitsi-web env: TURN_HOST/PORT/TRANSPORT
- NixOS firewall: 3478 tcp+udp, 49152-65535/udp range
- YC SG already has 3478/5349/49152-65535 from initial setup
This commit is contained in:
mikl 2026-07-13 01:19:55 +03:00
parent 897ea4bed2
commit 3d2f432619
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
hosts/heather/arion-compose.nix
View file

@ -179,6 +179,10 @@
AUTH_TYPE = "internal";
ENABLE_XMPP_WEBSOCKET = "1";
ENABLE_COLIBRI_WEBSOCKET = "1";
# TURN (coturn) — relay for clients behind symmetric NAT
TURN_HOST = "51.250.45.111";
TURN_PORT = "3478";
TURN_TRANSPORT = "udp";
};
};
@ -240,6 +244,21 @@
};
};
# === Coturn (TURN relay for jitsi) ===
# Host network: real client IPs + correct NAT traversal. No port conflicts
# on heather (no system coturn). Relays RTP on 49152-65535/udp.
# YC SG already has 3478/5349/49152-65535 open. Secret TURN_STATIC_AUTH_SECRET
# in jitsi.env (shared with jitsi-web via TURN_CREDENTIALS).
# Docs: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker#turn-server-configuration
jitsi-coturn = {
service.image = "coturn/coturn:4.7";
service.container_name = "jitsi-coturn";
service.restart = "unless-stopped";
service.network_mode = "host";
service.env_file = [ "/var/lib/jitsi-secrets/jitsi.env" ];
service.command = "-v --log-file=stdout --realm=turn.iscg.dev --external-ip=51.250.45.111 --use-auth-secret --static-auth-secret=$${TURN_STATIC_AUTH_SECRET} --min-port=49152 --max-port=65535 --listening-port=3478 --no-tls --no-dtls --fingerprint --no-cli --simple-log";
};
# === Silverbullet (note.iscg.dev) — ИСКЛЮЧЕНИЕ: bind mount ===
# Space = /srv/syncthing/herbarium (sync'ается syncthing на устройства).
# Единственный сервис без named volume — по твоему решению, чтобы notes

6
hosts/heather/default.nix
View file

@ -43,10 +43,16 @@
22000 # syncthing sync
22067 # strelaysrv (relay)
22070 # strelaysrv (status)
3478 # coturn TURN (tcp+udp)
];
firewall.allowedUDPPorts = [
22000 # syncthing sync (QUIC)
10000 # jitsi jvb (RTP media)
3478 # coturn TURN
];
# coturn RTP relay range
firewall.allowedUDPPortRanges = [
{ from = 49152; to = 65535; } # coturn RTP relay
];
};
# useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.