use-auth-secret

listening-port=3478
# tls-listening-port=5349
# cert=/etc/coturn/certs/fullchain.pem
# pkey=/etc/coturn/certs/privkey.pem

min-port=49152
max-port=65535

verbose
fingerprint
no-multicast-peers

# Block RFC1918 ranges to prevent TURN relay abuse
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=172.16.0.0-172.31.255.255

# static-auth-secret and realm are passed via CLI args in docker-compose.yml
# Do not put secrets in this file — it does not support variable substitution