host our own shit

docker-compose.yml

@@ -53,6 +53,11 @@ services:
       # Host networking on Linux → localhost works. WebRTC is opt-in; leave the
       # toggle in the UI off if MediaMTX is not running.
       OVERLORD_MEDIAMTX_URL: ${OVERLORD_MEDIAMTX_URL:-http://localhost:8889}
+      OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1}
+      OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478}
+      OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord}
+      OVERLORD_TURN_SECRET_FILE: /run/overlord-turn/secret
+      OVERLORD_TURN_CREDENTIAL_TTL_SECONDS: ${OVERLORD_TURN_CREDENTIAL_TTL_SECONDS:-3600}
     volumes:
       # overlord-data also caches downloaded cross-compile toolchains
       # under /app/data/toolchains, fetched on first agent build for a
@@ -61,6 +66,7 @@ services:
       - overlord-certs:/app/certs
       - overlord-client-build-cache:/app/client-build-cache
       - overlord-plugins:/app/plugins
+      - overlord-turn-secret:/run/overlord-turn:ro
       # Uncomment to mount host certbot certs read-only
       # - /etc/letsencrypt:/etc/letsencrypt:ro
       # Uncomment to use a static config file instead of env vars
@@ -76,6 +82,42 @@ services:
       timeout: 10s
       retries: 3
       start_period: 40s
+    depends_on:
+      turn-secret-init:
+        condition: service_completed_successfully
+
+  turn-secret-init:
+    image: alpine:3.22
+    command: ["/bin/sh", "-ec", "umask 077; if [ ! -s /run/overlord-turn/secret ]; then head -c 32 /dev/urandom | base64 > /run/overlord-turn/secret; fi; IFS= read -r turn_secret < /run/overlord-turn/secret; printf 'webrtcICEServers2:\n  - url: \"stun:%s:%s\"\n  - url: \"turn:%s:%s?transport=udp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n  - url: \"turn:%s:%s?transport=tcp\"\n    username: AUTH_SECRET\n    password: \"%s\"\n    clientOnly: true\n' \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" \"$${OVERLORD_TURN_HOST}\" \"$${OVERLORD_TURN_PORT}\" \"$$turn_secret\" > /run/overlord-turn/mediamtx.yml; chmod 0444 /run/overlord-turn/secret /run/overlord-turn/mediamtx.yml"]
+    environment:
+      OVERLORD_TURN_HOST: ${OVERLORD_TURN_HOST:-127.0.0.1}
+      OVERLORD_TURN_PORT: ${OVERLORD_TURN_PORT:-3478}
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn
+    restart: "no"
+
+  coturn:
+    image: coturn/coturn:4.14.0-r0-alpine
+    container_name: overlord-coturn
+    network_mode: host
+    entrypoint: ["/bin/sh", "-ec"]
+    command:
+      - |
+        secret="$$(cat /run/overlord-turn/secret)"
+        external=""
+        if [ -n "$${OVERLORD_TURN_EXTERNAL_IP:-}" ]; then external="--external-ip=$${OVERLORD_TURN_EXTERNAL_IP}"; fi
+        exec turnserver --fingerprint --use-auth-secret --static-auth-secret="$$secret" --realm="$${OVERLORD_TURN_REALM:-overlord}" --listening-port=3478 --min-port=49160 --max-port=49200 --no-tls --no-dtls --no-multicast-peers --log-file=stdout $$external
+    environment:
+      OVERLORD_TURN_REALM: ${OVERLORD_TURN_REALM:-overlord}
+      OVERLORD_TURN_EXTERNAL_IP: ${OVERLORD_TURN_EXTERNAL_IP:-}
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn:ro
+    depends_on:
+      turn-secret-init:
+        condition: service_completed_successfully
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
 
   mediamtx:
     image: bluenviron/mediamtx:latest
@@ -83,6 +125,12 @@ services:
     # Share the host network so WebRTC ICE candidates use the host's real
     # interfaces directly — no extra config needed for local or LAN browsers.
     network_mode: host
+    command: ["/run/overlord-turn/mediamtx.yml"]
+    volumes:
+      - overlord-turn-secret:/run/overlord-turn:ro
+    depends_on:
+      turn-secret-init:
+        condition: service_completed_successfully
     restart: unless-stopped
     environment:
       # Disable every protocol except WebRTC. The Overlord server proxies all
@@ -110,3 +158,4 @@ volumes:
   overlord-certs:
   overlord-client-build-cache:
   overlord-plugins:
+  overlord-turn-secret: