40_turn_docker.sh

#!/usr/bin/env bash
set -euo pipefail
source ./90_lib.sh; load_env

[[ "${TURN_ENABLE}" == "true" ]] || { info "TURN disabled; skipping"; exit 0; }
[[ "${TURN_DOCKER:-true}" == "true" ]] || { info "TURN_DOCKER=false; skipping docker installer"; exit 0; }

# ---------------- helpers ----------------
write_if_changed() {
  local dest="$1"; shift
  local tmp; tmp="$(mktemp)"
  cat > "$tmp"
  if [[ ! -f "$dest" ]] || ! cmp -s "$tmp" "$dest"; then
    install -D -m 0644 "$tmp" "$dest"
    echo "updated:$dest"
    changed_any=1
  else
    echo "unchanged:$dest"
  fi
  rm -f "$tmp"
}
copy_if_changed() {
  local src="$1" dest="$2" mode="${3:-0644}" owner="${4:-root}" group="${5:-root}"
  if [[ ! -f "$dest" ]] || ! cmp -s "$src" "$dest"; then
    install -D -m "$mode" -o "$owner" -g "$group" "$src" "$dest"
    echo "updated:$dest"
    changed_any=1
  else
    echo "unchanged:$dest"
  fi
}
changed_any=0

# ---------------- deps ----------------
log "TURN (docker): deps"
ensure_snap_certbot_cf
ensure_pkg ca-certificates curl gnupg apt-transport-https

# Docker (Ubuntu docker.io)
if ! command -v docker >/dev/null 2>&1; then
  ensure_pkg docker.io
  systemctl enable --now docker
fi

# Stop native coturn to free ports (idempotent)
systemctl disable --now coturn 2>/dev/null || true

# ---------------- certs ----------------
log "TURN (docker): cert"
issue_cert "${TURN_DOMAIN}" "${TURN_PROPAGATION_SECONDS:-${CF_PROPAGATION_SECONDS:-30}}"

# Copies readable by the container (ro mount).
install -d -m 0755 /etc/coturn/certs
copy_if_changed "/etc/letsencrypt/live/${TURN_DOMAIN}/fullchain.pem" /etc/coturn/certs/fullchain.pem 0644 root root
copy_if_changed "/etc/letsencrypt/live/${TURN_DOMAIN}/privkey.pem"  /etc/coturn/certs/privkey.pem  0644 root root

# ---------------- container spec ----------------
IMAGE="${TURN_DOCKER_IMAGE:-coturn/coturn:latest}"
CONTAINER_NAME="coturn"

# Detect if image supports Prometheus (only when requested)
PROM_OK=1
# (Optional sanity check; do NOT auto-disable)
if [[ "${TURN_PROM_ENABLE:-false}" == "true" ]]; then
  docker run --rm --network none "${IMAGE}" turnserver -h 2>/dev/null | grep -qi prometheus || \
    info "Prometheus flag not found in help; proceeding because TURN_PROM_ENABLE=true"
fi


# ---------------- strict minimal config ----------------
install -d -m 0755 /etc/coturn
CFG="/etc/coturn/turnserver.conf"

tmp_cfg="$(mktemp)"
# Put certs also in config (harmless redundancy), *but* we will pass them on CLI too.
cat > "$tmp_cfg" <<'CFG'
# --- TLS certs FIRST (redundant with CLI, but fine) ---
cert=/config/certs/fullchain.pem
pkey=/config/certs/privkey.pem

# --- listener ports ---
listening-port=3478
tls-listening-port=5349

# --- realm & auth ---
realm=%REALM%
user=%USERPASS%
lt-cred-mech
fingerprint

# --- relay port range ---
min-port=%MINPORT%
max-port=%MAXPORT%
CFG

# Fill placeholders
sed -i \
  -e "s|%REALM%|${TURN_REALM}|g" \
  -e "s|%USERPASS%|${TURN_USER}:${TURN_PASS}|g" \
  -e "s|%MINPORT%|${TURN_MIN_PORT}|g" \
  -e "s|%MAXPORT%|${TURN_MAX_PORT}|g" \
  "$tmp_cfg"

# Optional: explicit public IP and Prom metrics
if [[ -n "${TURN_PUBLIC_IP:-}" ]]; then
  echo "external-ip=${TURN_PUBLIC_IP}" >> "$tmp_cfg"
fi
if [[ "${TURN_PROM_ENABLE:-false}" == "true" && $PROM_OK -eq 1 ]]; then
  echo "prometheus" >> "$tmp_cfg"
  echo "prometheus-port=${TURN_PROM_PORT:-9641}" >> "$tmp_cfg"
fi

if [[ ! -f "$CFG" ]] || ! cmp -s "$tmp_cfg" "$CFG"; then
  install -D -m 0644 "$tmp_cfg" "$CFG"
  echo "updated:$CFG"
  changed_any=1
else
  echo "unchanged:$CFG"
fi
rm -f "$tmp_cfg"

# Persist spec hash (image + config) to decide recreation
cfg_hash="$(sha256sum "$CFG" | awk '{print $1}')"
spec_hash="$(printf '%s\n' "$IMAGE $cfg_hash" | sha256sum | awk '{print $1}')"
hash_file="/etc/coturn/docker.cfg.sha256"
prev_hash="$(cat "$hash_file" 2>/dev/null || true)"
need_recreate=0
if [[ "$prev_hash" != "$spec_hash" ]]; then
  printf '%s\n' "$spec_hash" > "$hash_file"
  echo "updated:$hash_file"
  need_recreate=1
else
  echo "unchanged:$hash_file"
fi

# Pull latest image (no-op if up-to-date)
docker pull "$IMAGE" >/dev/null || true

# Recreate container if needed
if docker inspect "$CONTAINER_NAME" >/dev/null 2>&1; then
  if [[ $need_recreate -eq 1 ]]; then
    info "Container spec changed; recreating"
    docker rm -f "$CONTAINER_NAME" >/dev/null 2>&1 || true
  fi
fi

# Run with:
#  - host networking (binds directly to 3478/5349)
#  - CLI-specified certs (pre-parse so TLS comes up)
#  - logging to stdout (so `docker logs` works)
#  - no telnet CLI (no empty password warning)
RUN_ARGS=( turnserver
  -c /config/turnserver.conf
  --cert /config/certs/fullchain.pem
  --pkey /config/certs/privkey.pem
  --simple-log
  --log-file=/dev/stdout
  --no-cli
  -v
)

if ! docker inspect "$CONTAINER_NAME" >/dev/null 2>&1; then
  docker run -d --name "$CONTAINER_NAME" \
    --restart unless-stopped \
    --network host \
    -v /etc/coturn:/config:ro \
    "$IMAGE" "${RUN_ARGS[@]}"
  echo "updated:container:$CONTAINER_NAME"
else
  info "Container unchanged; ensuring it’s running"
  docker start "$CONTAINER_NAME" >/dev/null || true
fi

# ---------------- firewall ----------------
ufw allow 3478,5349/tcp || true
ufw allow 3478,5349/udp || true
ufw allow ${TURN_MIN_PORT}:${TURN_MAX_PORT}/udp || true
# (Do NOT open ${TURN_PROM_PORT:-9641}; scrape locally if you enable it)

# ---------------- report ----------------
log "TURN (docker): report"
docker ps --filter "name=${CONTAINER_NAME}" --format 'table {{.Names}}\t{{.Image}}\t{{.Status}}'
ss -luntp | awk 'NR==1 || /:3478|:5349/' || true

# Print cert only if TLS is really listening
if ss -lnt | grep -q ':5349'; then
  info "TLS: $(echo | openssl s_client -connect ${TURN_DOMAIN}:5349 -servername ${TURN_DOMAIN} 2>/dev/null | openssl x509 -noout -subject -issuer -enddate || true)"
else
  warn "TLS 5349 not detected; run 'docker logs coturn --tail=100' to inspect."
fi

if [[ "${TURN_PROM_ENABLE:-false}" == "true" && $PROM_OK -eq 1 ]]; then
  info "Metrics (if enabled): http://127.0.0.1:${TURN_PROM_PORT:-9641}/metrics (blocked externally by UFW)."
fi

# Auto-reload container on cert renewals
HOOK="/etc/letsencrypt/renewal-hooks/deploy/30-coturn-docker-reload.sh"
write_if_changed "$HOOK" <<'H'
#!/usr/bin/env bash
docker kill -s HUP coturn 2>/dev/null || docker restart coturn 2>/dev/null || true
H
chmod +x "$HOOK"