coturn-server-config/README.md

WebRTC Outpost

Configuration repository for a Coturn relay that supports a Stoat deployment on GCP. The stack provisions a relay-main Ubuntu 24.04 instance, hardens the host with nftables, fail2ban, and unattended-upgrades, then deploys Coturn plus a Coraza-enabled Caddy reverse proxy with Podman Compose.

Repository Layout

• tofu/: OpenTofu infrastructure for the static IP, VM, and GCP firewall rule.
• ansible/: Host preparation and hardening for Ubuntu 24.04.
• compose/: Runtime configuration for Coturn and Caddy.
• docker/: Custom images for Coturn and Caddy.
• .github/workflows/: CI workflows for building images and deploying the stack.

Required GitHub Secrets

• R2_ACCESS_KEY_ID
• R2_SECRET_ACCESS_KEY
• CLOUDFLARE_ACCOUNT_ID
• GCP_SA_KEY
• SSH_PRIVATE_KEY
• TURN_SHARED_SECRET

Recommended GitHub Variables

• GCP_PROJECT
• GCP_REGION
• GCP_ZONE
• TURN_REALM
• CADDY_DOMAIN
• CADDY_EMAIL
• STOAT_UPSTREAM
• TURN_TLS_CERT_FILE
• TURN_TLS_KEY_FILE

Notes

• The OpenTofu S3 backend is configured at deploy time so the Cloudflare R2 endpoint does not need to be committed to the repository.
• The Google provider reads service account credentials from the standard GOOGLE_APPLICATION_CREDENTIALS shell environment variable. Set it to the JSON key file path for local tofu runs.
• The custom Coturn image renders runtime settings from environment variables before starting turnserver.
• TURN_TLS_CERT_FILE and TURN_TLS_KEY_FILE are optional. If they are omitted, Coturn starts on 3478 only and skips the 5349 TLS listener.
• The Ansible playbook lowers net.ipv4.ip_unprivileged_port_start to 80 so a rootless Podman-managed Caddy container can bind to 80 and 443.

Local OpenTofu Usage

Export the Google credentials path and required OpenTofu variables before running tofu locally:

export GOOGLE_APPLICATION_CREDENTIALS="secret-path"
export TF_VAR_gcp_project="your-gcp-project"
export TF_VAR_gcp_region="us-west1"
export TF_VAR_gcp_zone="us-west1-b"

cd tofu
tofu init
tofu apply

network_name defaults to default, instance_name defaults to relay-main, and admin_ssh_public_key is optional unless you want SSH access provisioned on the VM.