40 lines
1.1 KiB
Markdown
40 lines
1.1 KiB
Markdown
# coturn
|
|
|
|
Authenticated TURN for Synapse, exposed through MetalLB at `192.168.0.19`.
|
|
|
|
## Local deployment
|
|
|
|
The TURN shared secret is stored in Kubernetes as `turn-shared-secret` in the
|
|
`coturn` and `matrix` namespaces. It is never written into a committed file.
|
|
|
|
Bootstrap the existing secret once, then deploy:
|
|
|
|
```sh
|
|
TURN_SHARED_SECRET='<64-character-secret>' ./bootstrap-turn-secret.sh
|
|
./install.sh
|
|
```
|
|
|
|
## Gitea Actions CD
|
|
|
|
Bootstrap the restricted deployer and generate its kubeconfig:
|
|
|
|
```sh
|
|
./create-ci-kubeconfig.sh
|
|
```
|
|
|
|
When the Kubernetes API is reachable only through `dahoam`, use:
|
|
|
|
```sh
|
|
KUBECTL_SSH_HOST=dahoam \
|
|
SSH_CONFIG="$HOME/.ssh/config" \
|
|
./create-ci-kubeconfig.sh
|
|
```
|
|
|
|
Create one repository Actions secret named `KUBE_CONFIG_BASE64` containing the
|
|
single base64 line printed by that command. The deployer can update only the
|
|
existing coturn Services, ServiceAccount, Deployment, and Certificate. It
|
|
cannot read Kubernetes Secrets or modify RBAC.
|
|
|
|
No TURN secret is required in Gitea. The committed Deployment references the
|
|
existing Kubernetes Secret directly.
|