The TURN shared secret is stored in Kubernetes as turn-shared-secret in the coturn and matrix namespaces. It is never written into a committed file.

Bootstrap the existing secret once, then deploy:

TURN_SHARED_SECRET='<64-character-secret>' ./bootstrap-turn-secret.sh
./install.sh

Gitea Actions CD

Bootstrap the restricted deployer and generate its kubeconfig:

./create-ci-kubeconfig.sh

When the Kubernetes API is reachable only through dahoam, use:

KUBECTL_SSH_HOST=dahoam \
SSH_CONFIG="$HOME/.ssh/config" \
./create-ci-kubeconfig.sh

Create one repository Actions secret named KUBE_CONFIG_BASE64 containing the single base64 line printed by that command. The deployer can update only the existing coturn Services, ServiceAccount, Deployment, and Certificate. It cannot read Kubernetes Secrets or modify RBAC.

No TURN secret is required in Gitea. The committed Deployment references the existing Kubernetes Secret directly.