matrix-docker-ansible-deploy/roles/matrix-coturn/defaults/main.yml

matrix_coturn_enabled: true

matrix_coturn_docker_image: "instrumentisto/coturn:4.5.1.1"

# The Docker network that Coturn would be put into.
#
# Because Coturn relays traffic to unvalidated IP addresses,
# using a dedicated network, isolated from other Docker (and local) services is preferrable.
#
# Setting up deny/allow rules with `matrix_coturn_allowed_peer_ips`/`matrix_coturn_denied_peer_ips` is also
# possible for achieving such isolation, but is more complicated due to the dynamic nature of Docker networking.
matrix_coturn_docker_network: "matrix-coturn"

matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"
matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"

# List of systemd services that matrix-coturn.service depends on
matrix_coturn_systemd_required_services_list: ['docker.service']

# A list of additional "volumes" to mount in the container.
# This list gets populated dynamically at runtime. You can provide a different default value,
# if you wish to mount your own files into the container.
# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw|ro|slave|.."}
matrix_coturn_container_additional_volumes: []

# A shared secret (between Synapse and Coturn) used for authentication.
# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
matrix_coturn_turn_static_auth_secret: ""

# UDP port-range to use for TURN
matrix_coturn_turn_udp_min_port: 49152
matrix_coturn_turn_udp_max_port: 49172

# The external IP address of the machine where Coturn is.
matrix_coturn_turn_external_ip_address: ''

matrix_coturn_allowed_peer_ips: []
matrix_coturn_denied_peer_ips: []
matrix_coturn_user_quota: null
matrix_coturn_total_quota: null
Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`). 6 years ago			`matrix_coturn_enabled: true`

Update coturn (4.5.1.0 -> 4.5.1.1) 6 years ago			`matrix_coturn_docker_image: "instrumentisto/coturn:4.5.1.1"`
Split playbook into multiple roles As suggested in #63 (Github issue), splitting the playbook's logic into multiple roles will be beneficial for maintainability. This patch realizes this split. Still, some components affect others, so the roles are not really independent of one another. For example: - disabling mxisd (`matrix_mxisd_enabled: false`), causes Synapse and riot-web to reconfigure themselves with other (public) Identity servers. - enabling matrix-corporal (`matrix_corporal_enabled: true`) affects how reverse-proxying (by `matrix-nginx-proxy`) is done, in order to put matrix-corporal's gateway server in front of Synapse We may be able to move away from such dependencies in the future, at the expense of a more complicated manual configuration, but it's probably not worth sacrificing the convenience we have now. As part of this work, the way we do "start components" has been redone now to use a loop, as suggested in #65 (Github issue). This should make restarting faster and more reliable. 6 years ago
Isolate Coturn from services in the default Docker network Most (all?) of our Matrix services are running in the `matrix` network, so they were safe -- not accessible from Coturn to begin with. Isolating Coturn into its own network is a security improvement for people who were starting other services in the default Docker network. Those services were potentially reachable over the private Docker network from Coturn. Discussed in #120 (Github Pull Request) 6 years ago			`# The Docker network that Coturn would be put into.`
			`#`
			`# Because Coturn relays traffic to unvalidated IP addresses,`
			`# using a dedicated network, isolated from other Docker (and local) services is preferrable.`
			`#`
			# Setting up deny/allow rules with `matrix_coturn_allowed_peer_ips`/`matrix_coturn_denied_peer_ips` is also
			`# possible for achieving such isolation, but is more complicated due to the dynamic nature of Docker networking.`
			`matrix_coturn_docker_network: "matrix-coturn"`

Split playbook into multiple roles As suggested in #63 (Github issue), splitting the playbook's logic into multiple roles will be beneficial for maintainability. This patch realizes this split. Still, some components affect others, so the roles are not really independent of one another. For example: - disabling mxisd (`matrix_mxisd_enabled: false`), causes Synapse and riot-web to reconfigure themselves with other (public) Identity servers. - enabling matrix-corporal (`matrix_corporal_enabled: true`) affects how reverse-proxying (by `matrix-nginx-proxy`) is done, in order to put matrix-corporal's gateway server in front of Synapse We may be able to move away from such dependencies in the future, at the expense of a more complicated manual configuration, but it's probably not worth sacrificing the convenience we have now. As part of this work, the way we do "start components" has been redone now to use a loop, as suggested in #65 (Github issue). This should make restarting faster and more reliable. 6 years ago			`matrix_coturn_base_path: "{{ matrix_base_data_path }}/coturn"`
			`matrix_coturn_config_path: "{{ matrix_coturn_base_path }}/turnserver.conf"`

Make roles more independent of one another With this change, the following roles are now only dependent on the minimal `matrix-base` role: - `matrix-corporal` - `matrix-coturn` - `matrix-mailer` - `matrix-mxisd` - `matrix-postgres` - `matrix-riot-web` - `matrix-synapse` The `matrix-nginx-proxy` role still does too much and remains dependent on the others. Wiring up the various (now-independent) roles happens via a glue variables file (`group_vars/matrix-servers`). It's triggered for all hosts in the `matrix-servers` group. According to Ansible's rules of priority, we have the following chain of inclusion/overriding now: - role defaults (mostly empty or good for independent usage) - playbook glue variables (`group_vars/matrix-servers`) - inventory host variables (`inventory/host_vars/matrix.<your-domain>`) All roles default to enabling their main component (e.g. `matrix_mxisd_enabled: true`, `matrix_riot_web_enabled: true`). Reasoning: if a role is included in a playbook (especially separately, in another playbook), it should "work" by default. Our playbook disables some of those if they are not generally useful (e.g. `matrix_corporal_enabled: false`). 6 years ago			`# List of systemd services that matrix-coturn.service depends on`
			`matrix_coturn_systemd_required_services_list: ['docker.service']`

Add support for mounting additional volumes to matrix-coturn 6 years ago			`# A list of additional "volumes" to mount in the container.`
			`# This list gets populated dynamically at runtime. You can provide a different default value,`
			`# if you wish to mount your own files into the container.`
			# Contains definition objects like this: `{"src": "/outside", "dst": "/inside", "options": "rw\|ro\|slave\|.."}
			`matrix_coturn_container_additional_volumes: []`

Split playbook into multiple roles As suggested in #63 (Github issue), splitting the playbook's logic into multiple roles will be beneficial for maintainability. This patch realizes this split. Still, some components affect others, so the roles are not really independent of one another. For example: - disabling mxisd (`matrix_mxisd_enabled: false`), causes Synapse and riot-web to reconfigure themselves with other (public) Identity servers. - enabling matrix-corporal (`matrix_corporal_enabled: true`) affects how reverse-proxying (by `matrix-nginx-proxy`) is done, in order to put matrix-corporal's gateway server in front of Synapse We may be able to move away from such dependencies in the future, at the expense of a more complicated manual configuration, but it's probably not worth sacrificing the convenience we have now. As part of this work, the way we do "start components" has been redone now to use a loop, as suggested in #65 (Github issue). This should make restarting faster and more reliable. 6 years ago			`# A shared secret (between Synapse and Coturn) used for authentication.`
			# You can put any string here, but generating a strong one is preferred (e.g. `pwgen -s 64 1`).
			`matrix_coturn_turn_static_auth_secret: ""`

			`# UDP port-range to use for TURN`
			`matrix_coturn_turn_udp_min_port: 49152`
			`matrix_coturn_turn_udp_max_port: 49172`

Define matrix_coturn_turn_external_ip_address in the playbook group vars This is more explicit than hiding it in the role defaults. People who reuse the roles in their own playbook (and not only) may incorrectly define `ansible_host` to be a hostname or some local address. Making it more explicit is more likely to prevent such mistakes. 6 years ago			`# The external IP address of the machine where Coturn is.`
			`matrix_coturn_turn_external_ip_address: ''`

Add defaults for ips 6 years ago			`matrix_coturn_allowed_peer_ips: []`
			`matrix_coturn_denied_peer_ips: []`
Add nulls for quotas as well 6 years ago			`matrix_coturn_user_quota: null`
			`matrix_coturn_total_quota: null`