# Dev config for coturn. Verified against the official documentation
# (github.com/coturn/coturn/wiki/turnserver, docker/coturn/README.md).
# Runs with network_mode: host in docker-compose.yml (recommended by coturn
# docs for large UDP relay port ranges).
#
# Secrets (realm / static-auth-secret) come from .env via TURN_REALM /
# TURN_STATIC_AUTH_SECRET; coturn substitutes $(VAR) at startup when invoked
# through the image's docker-entrypoint.sh, which evaluates each CLI arg.
# Since we pass a config file instead of CLI flags, keep real secrets in the
# .env and inject them here through docker-compose "environment" + a
# lightweight envsubst step if/when TLS certs are added; for the dev/plain
# profile the plaintext defaults below are fine (`change-me` values only).

listening-port=3478
# Set to 443 in production (TURN over TLS) once real TLS certs are mounted.
tls-listening-port=5349

# Relay port range for TURN allocations.
min-port=49160
max-port=49200

# --- Long-term credential mechanism via shared secret (TURN REST API) ---
use-auth-secret
static-auth-secret=change-me-turn-secret
realm=vidconf.local

# Required by WebRTC clients (adds STUN FINGERPRINT attribute).
fingerprint

# No CLI/telnet admin interface in this dev deployment.
no-cli

# Uncomment and mount real certs to enable TURN over TLS on 443:
# cert=/etc/coturn/certs/cert.pem
# pkey=/etc/coturn/certs/key.pem

log-file=stdout
simple-log