first pass

coturn/turnserver.conf

@@ -0,0 +1,21 @@
+use-auth-secret
+
+listening-port=3478
+# tls-listening-port=5349
+# cert=/etc/coturn/certs/fullchain.pem
+# pkey=/etc/coturn/certs/privkey.pem
+
+min-port=49152
+max-port=65535
+
+verbose
+fingerprint
+no-multicast-peers
+
+# Block RFC1918 ranges to prevent TURN relay abuse
+denied-peer-ip=10.0.0.0-10.255.255.255
+denied-peer-ip=192.168.0.0-192.168.255.255
+denied-peer-ip=172.16.0.0-172.31.255.255
+
+# static-auth-secret and realm are passed via CLI args in docker-compose.yml
+# Do not put secrets in this file — it does not support variable substitution