The snikket_server image includes a TURN server that is enabled by default
(SNIKKET_TWEAK_TURNSERVER=1). A separate coturn container conflicts on port
3478 and adds unnecessary complexity for a standard deployment.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Use $$ instead of $ so Docker Compose does not interpolate TURN_SECRET
and SNIKKET_DOMAIN from the host environment. The container shell
expands them at runtime from env_file, which is both correct and avoids
exposing secret values in docker inspect output.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The webrtc table is not a recognized Prosody directive and was silently
ignored. TURN/STUN is already correctly configured via external_services.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add snikket_turn service (coturn/coturn) with STUN/TURN/TURNS support
- Mount snikket_data volume read-only for TLS certificates from snikket_certs
- Add TURN_SECRET to secrets.env.example
- Enable mod_external_services in Prosody and configure STUN/TURN/TURNS
endpoints so clients receive time-limited credentials via XMPP IQ
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
