mirror of
https://forgejo.ellis.link/continuwuation/continuwuity.git
synced 2026-11-14 04:37:00 +00:00
docs(livekit,turn): Standardize wording of TURN-over-TLS (on 443)
This commit is contained in:
1 parent
4d44f74235
commit
19662f389b
2 files changed
+11
-10
No files matched your search
@@ -465,7 +465,7 @@ Other:
|
||||
|
||||
## Appendix
|
||||
|
||||
### Additional TURNS-over-443 configuration
|
||||
### Additional TURN-over-TLS on 443 configuration
|
||||
|
||||
Most of the time, LiveKit [**does not need TURN**][sspaeth-matrix-voip-turn] to function. However, there are situations where clients may be unable to use nonstandard ports or UDP connections, such as in highly restrictive networks. In such cases, a TURN-over-TLS server on port 443 could relay traffic for the clients.
|
||||
|
||||
@@ -486,7 +486,7 @@ turn:
|
||||
|
||||
# Note: LiveKit will always advertise its TURN-over-TLS port on 443,
|
||||
# so further load balancing is needed to route back from port 443
|
||||
# to the port being configured here
|
||||
# on the host to the port being configured here
|
||||
tls_port: 5349
|
||||
|
||||
# Optional: configure an extra UDP port
|
||||
@@ -526,7 +526,8 @@ Then, configure a route from port 443 on the host back to the `livekit-turn.exam
|
||||
layer4 {
|
||||
@turn tls sni livekit-turn.example.com
|
||||
route @turn {
|
||||
proxy 127.0.0.1:5349 # forward to normal TURNS port
|
||||
# forward packages to LiveKit's TURN-over-TLS port
|
||||
proxy 127.0.0.1:5349
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -535,7 +536,7 @@ Then, configure a route from port 443 on the host back to the `livekit-turn.exam
|
||||
}
|
||||
}
|
||||
|
||||
# livekit configuration
|
||||
# Configuration for the LiveKit modules
|
||||
livekit.example.com {
|
||||
@lk-jwt-service path /healthz /get_token /sfu/get
|
||||
route @lk-jwt-service {
|
||||
@@ -562,7 +563,7 @@ max-port=65535
|
||||
|
||||
Then, generate a long random TURN secret for LiveKit, and add it to your coturn config under the `static-auth-secret` option. coturn allows multiple secrets in its configuration, so set a different one for LiveKit to use.
|
||||
|
||||
After that, refer to the following [TURNS-over-443 instructions](./turn#turns-over-443) to set up coturn with TLS, as well as multiplexing with LiveKit's websocket on port 443.
|
||||
After that, refer to the following [TURN-over-TLS on 443 instructions](./turn#turn-over-tls-on-443) to set up coturn with TLS, as well as multiplexing with LiveKit's websocket on port 443.
|
||||
|
||||
Then configure LiveKit, making sure to replace `COTURN_SECRET` with the one you generated:
|
||||
|
||||
@@ -581,4 +582,4 @@ Restart LiveKit, coturn, and Caddy-L4 to apply these changes.
|
||||
|
||||
</details>
|
||||
|
||||
Once the services are configured, run the Testing steps again to check that TURNS-over-443 is working. There should now be a green tick in the [LiveKit connection test page][livekit-connection-test] showing "Can connect to TURN" to confirm this is set up successfully.
|
||||
Once the services are configured, run the Testing steps again to check that TURN-over-TLS on 443 is working. There should now be a green tick in the [LiveKit connection test page][livekit-connection-test] showing "Can connect to TURN" to confirm this is set up successfully.
|
||||
+4
-4
@@ -223,11 +223,11 @@ If you instead prefer to use [eturnal][eturnal], you can refer to the guides bel
|
||||
[eturnal-continuwuity]: https://muoi.me/~stratself/articles/an-eturnal-to-rule-them-all/
|
||||
[synapse-eturnal-guide]: https://element-hq.github.io/synapse/latest/setup/turn/eturnal.html
|
||||
|
||||
### TURNS-over-443
|
||||
### TURN-over-TLS on 443
|
||||
|
||||
TURN servers are generally reachable on their default ports, as configured above. However, there are situations where clients may be unable to use nonstandard ports or UDP connections, such as in highly restrictive networks. In such cases, a TURN-over-TLS server on port 443 could relay traffic for the clients.
|
||||
|
||||
However, port 443 is usually used by other HTTPS services. Therefore, one would need to multiplex both TURNS and HTTPS on these ports, and filter packets to them via SNI routing.
|
||||
However, port 443 is usually used by other HTTPS services. Therefore, one would need to multiplex both TURN-over-TLS and HTTPS on these ports, and filter packets to them via SNI routing.
|
||||
|
||||
Below are examples to multiplex Coturn and [LiveKit](./livekit.mdx) on port 443, using [Caddy-L4][caddy-l4] on the host system.
|
||||
|
||||
@@ -237,7 +237,7 @@ Below are examples to multiplex Coturn and [LiveKit](./livekit.mdx) on port 443,
|
||||
|
||||
This Caddyfile:
|
||||
|
||||
- Route `turn.example.com` to the TURNS port for Coturn without TLS termination, and
|
||||
- Route `turn.example.com` to the TURN-over-TLS port for Coturn (port 5349) without TLS termination, and
|
||||
- Route `livekit.example.com` to the [LiveKit services](./livekit.mdx) with TLS termination by Caddy
|
||||
|
||||
Please note that all traffic from Coturn's perspective will be coming from Caddy-L4's IP now.
|
||||
@@ -337,7 +337,7 @@ https://turn.example.com {
|
||||
|
||||
</details>
|
||||
|
||||
After configuration and spin-up, the destination `turns:turn.example.com:443?transport=tcp` should work with Trickle ICE tests. You can now advertise it as an address in your `turn_uris` as well as [LiveKit](./livekit#additional-turns-over-443-configuration).
|
||||
After configuration and spin-up, the destination `turns:turn.example.com:443?transport=tcp` should work with Trickle ICE tests. You can now advertise it as an address in your `turn_uris` as well as [LiveKit](./livekit#additional-turn-over-tls-on-443-configuration).
|
||||
|
||||
[caddy-l4]: https://github.com/mholt/caddy-l4
|
||||
|
||||
|
||||
Reference in new issue
Block a user