sueta / deploy / turnserver.conf
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# coturn for sueta p2p stack — STUN + TURN with ephemeral REST credentials.
# The static-auth-secret is injected at deploy time (deploy-server.sh) and must
# equal STATIC_AUTH_SECRET in /etc/sueta-signal.env.

listening-port=3478
fingerprint

# ephemeral credentials (coturn REST API scheme, minted by sueta-signal)
use-auth-secret
static-auth-secret=__STATIC_AUTH_SECRET__
realm=ardegazu.ro

# relay port range
min-port=49152
max-port=65535

# hygiene
no-multicast-peers
no-cli
no-rfc5780
stale-nonce=600
user-quota=16
total-quota=200
max-bps=5000000

# SSRF hardening: never relay into private/loopback/link-local space.
# NOTE: the box's own PUBLIC IP must stay allowed — when two peers both use the
# relay, each one's permission targets the other's relayed address, which IS
# this box. Loopback/private space below still blocks reaching internal-only
# services.
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=224.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff

syslog
pidfile=/run/turnserver.pid