From 95778fc4076b2f24d2b0db7a3e4d389000bbc306 Mon Sep 17 00:00:00 2001
From: boxswapper <boxswappers@gmail.com>
Date: Thu, 19 Mar 2026 22:05:03 -0600
Subject: [PATCH] updated to allow voice chat

---
 group_vars/all.yml                            |  8 ++++-
 roles/common/tasks/main.yml                   |  7 ++++
 roles/matrix-synapse/tasks/main.yml           | 25 ++++++++++++++
 .../templates/homeserver.yaml.j2              | 21 ++++++++++++
 roles/nginx-proxy/templates/default.conf.j2   | 33 +++++++++++++++++++
 5 files changed, 93 insertions(+), 1 deletion(-)

diff --git a/group_vars/all.yml b/group_vars/all.yml
index b046ca4..83b2199 100644
--- a/group_vars/all.yml
+++ b/group_vars/all.yml
@@ -22,4 +22,10 @@ landing_domain: "example.com"  # optional, or use same domain + path-based routi
 certbot_email: "admin@example.com"
 
 # Static site path
-nginx_webroot: "/var/lib/matrix-nginx"
\ No newline at end of file
+nginx_webroot: "/var/lib/matrix-nginx"
+
+coturn_shared_secret: "{{ 'your-secret-key' | password_hash('sha512', 'salt') }}"
+# Or generate randomly:
+# coturn_shared_secret: "{{ 24 | random_string | password_hash('sha512') }}"
+coturn_username: "matrix-turn"
+coturn_password: "{{ vault_coturn_password }}"
\ No newline at end of file
diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml
index b5835fe..858a304 100644
--- a/roles/common/tasks/main.yml
+++ b/roles/common/tasks/main.yml
@@ -21,3 +21,10 @@
   loop:
     - "{{ synapse_data_dir }}"
     - "{{ nginx_webroot }}"
+
+# roles/matrix-synapse/tasks/main.yml
+- name: Restart Synapse to reload TURN config
+  container:
+    name: synapse
+    state: started
+    restart: yes
\ No newline at end of file
diff --git a/roles/matrix-synapse/tasks/main.yml b/roles/matrix-synapse/tasks/main.yml
index 342510d..e4942ee 100644
--- a/roles/matrix-synapse/tasks/main.yml
+++ b/roles/matrix-synapse/tasks/main.yml
@@ -67,3 +67,28 @@
       - "{{ synapse_data_dir }}:/data"
     command: >
       -c /data/homeserver.yaml
+#----- Coturn + Synapse 
+- name: Run Coturn container (STUN/TURN server)
+  container:
+    name: coturn
+    image: coturn/coturn:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    env:
+      LISTENING_PORT: "3478"
+      ALTERNATE_LISTENING_PORT: "5349"
+      RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}"  # or your server IP
+      EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
+      # Shared secret for dynamic credentials
+      TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
+      # Enable TLS
+      TURNSERVER_TLS_LISTENING_PORT: "5349"
+      TURNSERVER_CERT: "/etc/turnserver/tls.crt"
+      TURNSERVER_PKEY: "/etc/turnserver/tls.key"
+      NO_AUTH_TIMESTAMPS: "true"
+      REALM: "{{ matrix_domain }}"
+    # Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
+    volumes:
+      - "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
+  register: coturn_cont
\ No newline at end of file
diff --git a/roles/matrix-synapse/templates/homeserver.yaml.j2 b/roles/matrix-synapse/templates/homeserver.yaml.j2
index 8a2e0b6..db1a817 100644
--- a/roles/matrix-synapse/templates/homeserver.yaml.j2
+++ b/roles/matrix-synapse/templates/homeserver.yaml.j2
@@ -35,3 +35,24 @@ rc_flood_control:
 # Enable password login
 enable_registration: true
 enable_registration_without_verification: true
+
+
+## -- turn settings
+# Voice & Video Chat Settings
+media_store_path: /data/media_store
+max_image_pixels: 32000000  # 32MP max
+
+# TURN/STUN server config
+turn_uris:
+  - "turn:{{ matrix_domain }}:3478?transport=udp"
+  - "turn:{{ matrix_domain }}:3478?transport=tcp"
+  - "turns:{{ matrix_domain }}:5349?transport=tcp"  # encrypted TURN
+
+turn_shared_secret: "{{ coturn_shared_secret }}"
+turn_username: "{{ coturn_username }}"
+turn_password: "{{ coturn_password }}"
+turn_time_limit: 86400  # 24h (optional)
+turn_allow_guests: true  # allow non-Matrix users (e.g., web guests)
+
+# Optional: Enable call features
+enable_call_signalling: true
\ No newline at end of file
diff --git a/roles/nginx-proxy/templates/default.conf.j2 b/roles/nginx-proxy/templates/default.conf.j2
index 00dc23a..543304c 100644
--- a/roles/nginx-proxy/templates/default.conf.j2
+++ b/roles/nginx-proxy/templates/default.conf.j2
@@ -57,4 +57,37 @@ server {
     location /admin {
         return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
     }
+}
+
+#--- Coturn changes --- #
+
+# TURN over TLS (port 443) — proxied to Coturn's 5349
+# Only needed if you want TURN on 443 (avoids firewall issues)
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream coturn_tls {
+    server 127.0.0.1:5349;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # ... [existing TLS config] ...
+
+    # TURN over TLS (for UDP/TCP fallback on port 443)
+    location /turn {
+        proxy_pass https://coturn_tls;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_read_timeout 86400;
+    }
+
+    # Or simpler: proxy UDP via a dedicated TCP tunnel (advanced)
+    # For most cases, just expose 3478/5349 directly → no Nginx needed!
 }
\ No newline at end of file