# coturn configuration for NetBird (operator-provided). This example is insecure; the
# operator overrides the credentials and sets external-ip in production.
#
# TLS (5349) is intentionally disabled: NetBird uses STUN/TURN over 3478 and the payloads
# are already authenticated by the long-term credential mechanism. Enabling TLS would
# require certificates, which this cookbook does not manage.

# STUN/TURN listener (UDP + TCP).
listening-port=3478
no-tls
no-dtls

# UDP relay port range for relayed media. These, together with 3478/udp, are the only
# NetBird ports that must be reachable directly from the Internet (they cannot go through
# an HTTP reverse proxy). Keep this range in sync with the firewall.
min-port=49152
max-port=65535

# Long-term credentials. The user/password MUST match the "TURNConfig.Turns" entry in
# management.json.
fingerprint
lt-cred-mech
user=self:ebfea0b4d8e2443952b950a2d6ac600e
realm=netbird

# Behind NAT, uncomment and set the public IP so coturn advertises the correct relayed
# address (XOR-RELAYED-ADDRESS). On a host with a public IP directly, coturn auto-detects it.
#external-ip=203.0.113.10

# Logging and runtime.
log-file=stdout
no-software-attribute
no-cli
pidfile=/var/tmp/turnserver.pid