apiVersion: v1
kind: ServiceAccount
metadata:
  name: coturn
  namespace: coturn
  labels:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
automountServiceAccountToken: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: coturn
  namespace: coturn
  labels:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
    app.kubernetes.io/version: 4.10.0-r1
spec:
  replicas: 1
  revisionHistoryLimit: 3
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app.kubernetes.io/name: coturn
      app.kubernetes.io/instance: coturn
  template:
    metadata:
      labels:
        app.kubernetes.io/name: coturn
        app.kubernetes.io/instance: coturn
    spec:
      serviceAccountName: coturn
      automountServiceAccountToken: false
      containers:
        - name: coturn
          image: coturn/coturn:4.10.0-r1
          imagePullPolicy: IfNotPresent
          args:
            - --listening-port=3478
            - --tls-listening-port=5349
            - --fingerprint
            - --cert=/etc/ssl/certs/cert.pem
            - --pkey=/etc/ssl/private/privkey.pem
            - --realm=brunner.ninja
            - --log-file=stdout
            - --no-software-attribute
            - --no-cli
            - --use-auth-secret
            - --static-auth-secret=$(TURN_SHARED_SECRET)
            - --external-ip=37.186.4.16
            - --min-port=49160
            - --max-port=49200
            - --no-multicast-peers
          env:
            - name: TURN_SHARED_SECRET
              valueFrom:
                secretKeyRef:
                  name: turn-shared-secret
                  key: shared-secret
          ports:
            - name: tcp
              containerPort: 3478
              protocol: TCP
            - name: udp
              containerPort: 3478
              protocol: UDP
            - name: tcp-tls
              containerPort: 5349
              protocol: TCP
            - name: udp-tls
              containerPort: 5349
              protocol: UDP
          readinessProbe:
            tcpSocket:
              port: tcp
          livenessProbe:
            tcpSocket:
              port: tcp
            initialDelaySeconds: 30
          resources:
            requests:
              cpu: 100m
              memory: 50Mi
            limits:
              cpu: 100m
              memory: 50Mi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              add:
                - NET_BIND_SERVICE
              drop:
                - ALL
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 65534
          volumeMounts:
            - name: certs
              mountPath: /etc/ssl/certs
              readOnly: true
            - name: private
              mountPath: /etc/ssl/private
              readOnly: true
      volumes:
        - name: certs
          secret:
            secretName: coturn
            items:
              - key: tls.crt
                path: cert.pem
        - name: private
          secret:
            secretName: coturn
            items:
              - key: tls.key
                path: privkey.pem
---
apiVersion: v1
kind: Service
metadata:
  name: coturn-tcp
  namespace: coturn
  labels:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
  annotations:
    metallb.io/loadBalancerIPs: "192.168.0.19"
    metallb.io/allow-shared-ip: coturn
    mikrotik.brunner.ninja/router: newgw
    mikrotik.brunner.ninja/forwardings: >-
      [{"name":"3478-tcp","servicePort":"tcp","dstAddressList":"WANs"},{"name":"5349-tcp","servicePort":"tcp-tls","dstAddressList":"WANs"}]
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
  ports:
    - name: tcp
      port: 3478
      targetPort: tcp
      protocol: TCP
    - name: tcp-tls
      port: 5349
      targetPort: tcp-tls
      protocol: TCP
---
apiVersion: v1
kind: Service
metadata:
  name: coturn-udp
  namespace: coturn
  labels:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
  annotations:
    metallb.io/loadBalancerIPs: "192.168.0.19"
    metallb.io/allow-shared-ip: coturn
    mikrotik.brunner.ninja/router: newgw
    mikrotik.brunner.ninja/forwardings: >-
      [{"name":"3478-udp","servicePort":"udp","dstAddressList":"WANs"},{"name":"5349-udp","servicePort":"udp-tls","dstAddressList":"WANs"}]
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local
  selector:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
  ports:
    - name: udp
      port: 3478
      targetPort: udp
      protocol: UDP
    - name: udp-tls
      port: 5349
      targetPort: udp-tls
      protocol: UDP
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: coturn
  namespace: coturn
  labels:
    app.kubernetes.io/name: coturn
    app.kubernetes.io/instance: coturn
spec:
  secretName: coturn
  dnsNames:
    - brunner.ninja
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: letsencrypt-dns
  usages:
    - digital signature
    - key encipherment