1.1 KiB
coturn
Authenticated TURN for Synapse, exposed through MetalLB at 192.168.0.19.
Local deployment
The TURN shared secret is stored in Kubernetes as turn-shared-secret in the
coturn and matrix namespaces. It is never written into a committed file.
Bootstrap the existing secret once, then deploy:
TURN_SHARED_SECRET='<64-character-secret>' ./bootstrap-turn-secret.sh
./install.sh
Gitea Actions CD
Bootstrap the restricted deployer and generate its kubeconfig:
./create-ci-kubeconfig.sh
When the Kubernetes API is reachable only through dahoam, use:
KUBECTL_SSH_HOST=dahoam \
SSH_CONFIG="$HOME/.ssh/config" \
./create-ci-kubeconfig.sh
Create one repository Actions secret named KUBE_CONFIG_BASE64 containing the
single base64 line printed by that command. The deployer can update only the
existing coturn Services, ServiceAccount, Deployment, and Certificate. It
cannot read Kubernetes Secrets or modify RBAC.
No TURN secret is required in Gitea. The committed Deployment references the existing Kubernetes Secret directly.