synapse_ynh/conf/turnserver.conf

lt-cred-mech
use-auth-secret
static-auth-secret=__TURNSERVER_PWD__
realm=__DOMAIN__

tls-listening-port=__PORT_TURNSERVER_TLS__
alt-tls-listening-port=__PORT_TURNSERVER_ALT_TLS__
min-port=49153
max-port=49193
cli-port=__PORT_CLI__

cert=/etc/yunohost/certs/__DOMAIN__/crt.pem
pkey=/etc/yunohost/certs/__DOMAIN__/key.pem
dh-file=/etc/ssl/private/dh2048.pem

_TURN_CLEAR_COM_PARAM_

# Block old protocols
no-sslv2
no-sslv3
no-tlsv1
no-tlsv1_1

log-file=/var/log/matrix-__APP__/turnserver.log
pidfile=/run/coturn-__APP__/turnserver.pid
simple-log

# consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS.
user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user.
total-quota=1200

# recommended additional local peers to block, to mitigate external access to internal services.
# https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/#how-to-fix-an-open-turn-relay-to-address-this-vulnerability
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=127.0.0.0-127.255.255.255

# Max time 12h
max-allocate-lifetime=43200

_TURN_EXTERNAL_IP_
First commit 2017-02-13 20:43:41 +01:00			`lt-cred-mech`
			`use-auth-secret`
Implement group permission support and use new helper for config file 2020-12-15 22:25:29 +01:00			`static-auth-secret=__TURNSERVER_PWD__`
First commit 2017-02-13 20:43:41 +01:00			`realm=__DOMAIN__`

Full rework of all scripts - Adapt all script with packaging v2 - Rework cleanly control pannel and remove all replace in file as it's breaken after each update - Cleanup 2023-11-01 18:52:07 +01:00			`tls-listening-port=__PORT_TURNSERVER_TLS__`
			`alt-tls-listening-port=__PORT_TURNSERVER_ALT_TLS__`
Use a port range wich don't contain the upnp service 2018-06-20 19:22:25 +02:00			`min-port=49153`
			`max-port=49193`
Full rework of all scripts - Adapt all script with packaging v2 - Rework cleanly control pannel and remove all replace in file as it's breaken after each update - Cleanup 2023-11-01 18:52:07 +01:00			`cli-port=__PORT_CLI__`
First commit 2017-02-13 20:43:41 +01:00
			`cert=/etc/yunohost/certs/__DOMAIN__/crt.pem`
			`pkey=/etc/yunohost/certs/__DOMAIN__/key.pem`
Fix dh_file path on turnserver config 2020-05-20 22:08:14 +02:00			`dh-file=/etc/ssl/private/dh2048.pem`
First commit 2017-02-13 20:43:41 +01:00
Avoid to block crear communication when call over dtls is disabled 2024-03-09 16:33:03 +01:00			`_TURN_CLEAR_COM_PARAM_`
Improve coturn config 2024-03-09 01:51:57 +01:00
			`# Block old protocols`
First commit 2017-02-13 20:43:41 +01:00			`no-sslv2`
Full upgrade - Add multi instance support - Remove offical helper in common.sh - Improve turnserver config - Update checkprocess - Check synapse is fully started before the end script - Use helper nginx ynh_add_nginx_config 2018-01-19 22:05:39 +01:00			`no-sslv3`
Update Turnserver config - Add full relay support (turn) : - Open ports range (49152 - 49192) - Set external-ip (for nat) - Enable stun mode - Improve log management - Improve security 2018-05-06 00:35:58 +02:00			`no-tlsv1`
Fix and improve coturn config 2020-05-20 23:41:04 +02:00			`no-tlsv1_1`
Update Turnserver config - Add full relay support (turn) : - Open ports range (49152 - 49192) - Set external-ip (for nat) - Enable stun mode - Improve log management - Improve security 2018-05-06 00:35:58 +02:00
Full upgrade - Add multi instance support - Remove offical helper in common.sh - Improve turnserver config - Update checkprocess - Check synapse is fully started before the end script - Use helper nginx ynh_add_nginx_config 2018-01-19 22:05:39 +01:00			`log-file=/var/log/matrix-__APP__/turnserver.log`
Remplace /var/run by /run 2020-11-28 17:31:45 +01:00			`pidfile=/run/coturn-__APP__/turnserver.pid`
Update Turnserver config - Add full relay support (turn) : - Open ports range (49152 - 49192) - Set external-ip (for nat) - Enable stun mode - Improve log management - Improve security 2018-05-06 00:35:58 +02:00			`simple-log`
Implement group permission support and use new helper for config file 2020-12-15 22:25:29 +01:00
Remplement TLS/DTLS for calls 2024-02-26 22:35:05 +01:00			`# consider whether you want to limit the quota of relayed streams per user (or total) to avoid risk of DoS.`
			`user-quota=12 # 4 streams per video call, so 12 streams = 3 simultaneous relayed calls per user.`
			`total-quota=1200`

Improve coturn config 2024-03-09 01:51:57 +01:00			`# recommended additional local peers to block, to mitigate external access to internal services.`
			`# https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/#how-to-fix-an-open-turn-relay-to-address-this-vulnerability`
			`no-multicast-peers`
			`denied-peer-ip=0.0.0.0-0.255.255.255`
			`denied-peer-ip=127.0.0.0-127.255.255.255`

Remplement TLS/DTLS for calls 2024-02-26 22:35:05 +01:00			`# Max time 12h`
			`max-allocate-lifetime=43200`

Full rework of all scripts - Adapt all script with packaging v2 - Rework cleanly control pannel and remove all replace in file as it's breaken after each update - Cleanup 2023-11-01 18:52:07 +01:00			`_TURN_EXTERNAL_IP_`