# coturn

Authenticated TURN for Synapse, exposed through MetalLB at `192.168.0.19`.

## Local deployment

The TURN shared secret is stored in Kubernetes as `turn-shared-secret` in the
`coturn` and `matrix` namespaces. It is never written into a committed file.

Bootstrap the existing secret once, then deploy:

```sh
TURN_SHARED_SECRET='<64-character-secret>' ./bootstrap-turn-secret.sh
./install.sh
```

## Gitea Actions CD

Bootstrap the restricted deployer and generate its kubeconfig:

```sh
./create-ci-kubeconfig.sh
```

When the Kubernetes API is reachable only through `dahoam`, use:

```sh
KUBECTL_SSH_HOST=dahoam \
SSH_CONFIG="$HOME/.ssh/config" \
./create-ci-kubeconfig.sh
```

Create one repository Actions secret named `KUBE_CONFIG_BASE64` containing the
single base64 line printed by that command. The deployer can update only the
existing coturn Services, ServiceAccount, Deployment, and Certificate. It
cannot read Kubernetes Secrets or modify RBAC.

No TURN secret is required in Gitea. The committed Deployment references the
existing Kubernetes Secret directly.