64 lines
1.8 KiB
Markdown
64 lines
1.8 KiB
Markdown
 
|
---
|
||
|
|
title: TURN Server
|
||
|
|
description: coturn für WebRTC-Video-Calls
|
||
|
|
published: true
|
||
|
|
date: 2026-08-13T18:05:00.737Z
|
||
|
|
tags:
|
||
|
|
editor: markdown
|
||
|
|
dateCreated: 2026-08-13T18:05:00.737Z
|
||
|
|
---
|
||
|
|
|
||
|
|
**Status**: ✅ Vollständig deployed
|
||
|
|
**Domain**: `turn.axion1337.chat`
|
||
|
|
**Public IP**: `49.13.132.245`
|
||
|
|
|
||
|
|
## Problem & Lösung
|
||
|
|
|
||
|
|
Videocalls scheitern mit DTLS-Timeout bei Clients hinter NAT/Firewall. **Lösung**: coturn als TURN-Relay.
|
||
|
|
|
||
|
|
## Architektur
|
||
|
|
|
||
|
|
Client A ──→ coturn (turn.axion1337.chat) ──→ Client B
|
||
|
|
|
||
|
|
- **Ports**: 3478/udp, 3478/tcp, 5349/tcp, 49152-65535/udp
|
||
|
|
- **Auth**: HMAC-basiert mit Shared Secret zwischen coturn + Synapse
|
||
|
|
- **Deployment**: K3S Deployment mit `hostNetwork: true`
|
||
|
|
|
||
|
|
## Dateien (in `apps/production/`)
|
||
|
|
|
||
|
|
| Datei | Inhalt |
|
||
|
|
|-------|--------|
|
||
|
|
| `coturn.yaml` | ConfigMap + Deployment + Service |
|
||
|
|
| `coturn-secret.yaml` | SOPS-Secret: `TURN_SECRET` |
|
||
|
|
| `synapse-turn-secret.yaml` | SOPS-Secret: TURN URIs + shared secret für Synapse (seit 2026-07-28, vorher fälschlich im Klartext in `custom-configs/synapse-values.yaml` - siehe Issue #38) |
|
||
|
|
| `turn-secret-rotation-secret.yaml` + `turn-secret-rotation.yaml` | Monatlicher automatisierter Rotations-CronJob (Issue #38) - eigener gescopter age-Key, öffnet PR statt direkt zu pushen |
|
||
|
|
| `matrix-certificates.yaml` | cert-manager Cert für `turn.axion1337.chat` |
|
||
|
|
|
||
|
|
## DNS & Firewall (manuell)
|
||
|
|
|
||
|
|
```
|
||
|
|
DNS A-Record: turn.axion1337.chat → 49.13.132.245
|
||
|
|
|
||
|
|
Firewall (K3S Host):
|
||
|
|
ufw allow 3478/udp
|
||
|
|
ufw allow 3478/tcp
|
||
|
|
ufw allow 5349/tcp
|
||
|
|
ufw allow 49152:65535/udp
|
||
|
|
```
|
||
|
|
|
||
|
|
## Verifikation
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# Pod läuft?
|
||
|
|
kubectl get pods -n matrix -l app=coturn
|
||
|
|
|
||
|
|
# Certificate ready?
|
||
|
|
kubectl get certificate -n matrix | grep turn
|
||
|
|
|
||
|
|
# Extern testen
|
||
|
|
docker run -it instrumentisto/coturn \
|
||
|
|
turnutils_uclient -v -T -u test -w test turn.axion1337.chat
|
||
|
|
```
|
||
|
|
|
||
|
|
**Weitere Details**: Siehe vollständige Dokumentation oben.
|