# Coturn TURN/STUN Server Configuration for MyTelegram VoIP
# Based on RFC 5766 (TURN) and RFC 5389 (STUN)

# Listen on all interfaces (Docker compatibility)
listening-ip=0.0.0.0

# Listening port for TURN/STUN
listening-port=3478

# TLS listening port (disabled for local testing)
# tls-listening-port=5349

# Relay ports range for media
min-port=49152
max-port=65535

# Server realm (domain)
realm=mytelegram.local

# Authentication
# Use long-term credentials
lt-cred-mech

# User credentials (username:password)
# Format: user=username:password
# In production, use strong passwords and rotate regularly
user=user:CHANGE_ME

# Logging
verbose
log-file=/var/log/coturn/turnserver.log

# Performance tuning
# Total quota (bytes per allocation)
total-quota=100
# Bandwidth per session (bytes/sec)
bps-capacity=0

# No multicast
no-multicast-peers

# Disable software attributes
no-software-attribute

# Mobility
mobility

# WebRTC compatibility
fingerprint

# Secure communication (TLS disabled for local testing)
# no-tls
# no-dtls

# TLS/DTLS certificate paths (optional, for TLS)
# cert=/etc/coturn/cert.pem
# pkey=/etc/coturn/key.pem

# CLI
cli-password=CHANGE_CLI_PASSWORD

# Allow TURN for specific IP ranges (optional)
# allowed-peer-ip=10.0.0.0-10.255.255.255
# denied-peer-ip=192.168.0.0-192.168.255.255

# Database for persistent storage (optional)
# psql-userdb="host=postgresql dbname=coturn user=coturn password=password"

# Redis for  session management (optional)
# redis-userdb="ip=redis dbname=0 password=turn connect_timeout=30"

# Prometheus metrics (optional)
# prometheus

# Disable UDP relay endpoints
# no-udp-relay

# Use external IP (important for NAT)
# Must match App__WebRtcConnections__0__Ip in .env
# For local testing use 127.0.0.1, for production use your public IP
external-ip=127.0.0.1