host our own shit

docker-compose.windows.yml

@@ -49,13 +49,22 @@ services:
       OVERLORD_FILE_UPLOAD_PULL_TTL_MS: ${OVERLORD_FILE_UPLOAD_PULL_TTL_MS:-1800000}
       # WebRTC: Bun reaches MediaMTX via the docker service name on bridge net.
       OVERLORD_MEDIAMTX_URL: ${OVERLORD_MEDIAMTX_URL:-http://mediamtx:8889}
+      OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1}
+      OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478}
+      OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord}
+      OVERLORD_TURN_SECRET_FILE: /run/overlord-turn/secret
+      OVERLORD_TURN_CREDENTIAL_TTL_SECONDS: ${OVERLORD_TURN_CREDENTIAL_TTL_SECONDS:-3600}
     depends_on:
-      - mediamtx
+      mediamtx:
+        condition: service_started
+      turn-secret-init:
+        condition: service_completed_successfully
     volumes:
       - overlord-data:/app/data
       - overlord-certs:/app/certs
       - overlord-client-build-cache:/app/client-build-cache
       - overlord-plugins:/app/plugins
+      - overlord-turn-secret:/run/overlord-turn:ro
       # Uncomment to mount host certbot certs read-only
       # - /etc/letsencrypt:/etc/letsencrypt:ro
       # Uncomment to use a static config file instead of env vars
@@ -72,10 +81,47 @@ services:
       retries: 3
       start_period: 40s
 
+  turn-secret-init:
+    image: alpine:3.22
+    command: ["/bin/sh", "-ec", "umask 077; if [ ! -s /run/overlord-turn/secret ]; then head -c 32 /dev/urandom | base64 > /run/overlord-turn/secret; fi; IFS= read -r turn_secret < /run/overlord-turn/secret; printf 'webrtcICEServers2:\n  - url: \"stun:%s:%s\"\n  - url: \"turn:%s:%s?transport=udp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n  - url: \"turn:%s:%s?transport=tcp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n' \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" > /run/overlord-turn/mediamtx.yml; chmod 0444 /run/overlord-turn/secret /run/overlord-turn/mediamtx.yml"]
+    environment:
+      OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1}
+      OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478}
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn
+    restart: "no"
+
+  coturn:
+    image: coturn/coturn:4.14.0-r0-alpine
+    container_name: overlord-coturn
+    ports:
+      - "3478:3478/udp"
+      - "3478:3478/tcp"
+      - "49160-49200:49160-49200/udp"
+    entrypoint: ["/bin/sh", "-ec"]
+    command:
+      - |
+        secret="$$(cat /run/overlord-turn/secret)"
+        external=""
+        if [ -n "$${OVERLORD_TURN_EXTERNAL_IP:-}" ]; then external="--external-ip=$${OVERLORD_TURN_EXTERNAL_IP}"; fi
+        exec turnserver --fingerprint --use-auth-secret --static-auth-secret="$$secret" --realm="$${OVERLORD_TURN_REALM:-overlord}" --listening-port=3478 --min-port=49160 --max-port=49200 --no-tls --no-dtls --no-multicast-peers --log-file=stdout $$external
+    environment:
+      OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord}
+      OVERLORD_TURN_EXTERNAL_IP: ${OVERLORD_TURN_EXTERNAL_IP:-127.0.0.1}
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn:ro
+    depends_on:
+      turn-secret-init:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+
   mediamtx:
     image: bluenviron/mediamtx:latest
     container_name: overlord-mediamtx
     restart: unless-stopped
+    command: ["/run/overlord-turn/mediamtx.yml"]
     ports:
       # WHIP/WHEP signaling only reached by the Bun container internally,
       # so we don't publish 8889. ICE UDP/TCP must be reachable from the
@@ -97,9 +143,15 @@ services:
       # a different machine, override with the host's LAN/public IP, e.g.:
       #   OVERLORD_WEBRTC_ADDITIONAL_HOSTS=127.0.0.1,192.168.1.42
       MTX_WEBRTCADDITIONALHOSTS: ${OVERLORD_WEBRTC_ADDITIONAL_HOSTS:-127.0.0.1}
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn:ro
+    depends_on:
+      turn-secret-init:
+        condition: service_completed_successfully
 
 volumes:
   overlord-data:
   overlord-certs:
   overlord-client-build-cache:
   overlord-plugins:
+  overlord-turn-secret: