discoman/python-tdd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

coturn: optional dual-stack TURN via guarded coturn_public_ip6

Browse Source 
Set coturn_public_ip6 in inventory to advertise IPv6 relay candidates (2nd external-ip) AND emit matching v6 denied-peer-ip ranges (::1, fe80::/10, fc00::/7) for SSRF parity with the v4 lockdown. Unset → byte-identical pure-IPv4 config as before, so it's zero-risk opt-in. Droplet now has IPv6 on; this makes the conf dual-stack-ready.

Code architected by Disco DeDisco <discodedisco@outlook.com>
Git commit message Co-Authored-By:
Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Disco DeDisco
2026-05-27 14:10:28 -04:00
parent 41217d5438
commit c9a61e5614
2 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
infra/inventory.ini
View File

@@ -13,5 +13,8 @@ gitea.earthmanrpg.me ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_ed
# coturn-playbook.yaml. UNCOMMENT + fill once the droplet + static IP exist
# (see the playbook header). coturn_secret must equal the app's
# COTURN_SHARED_SECRET. coturn_private_ip / coturn_tls_* are optional.
# coturn_public_ip6 (optional): set the droplet's public IPv6 to serve
# dual-stack TURN (adds a v6 external-ip + matching v6 peer-denial lockdown);
# leave unset for a pure-IPv4 relay.
# [coturn]
# turn.earthmanrpg.me ansible_user=root ansible_ssh_private_key_file=~/.ssh/id_ed25519_wsl_python-tdd coturn_secret=CHANGEME coturn_realm=earthmanrpg.me coturn_public_ip=CHANGEME