updated to allow voice chat

group_vars/all.yml

@@ -23,3 +23,9 @@ certbot_email: "admin@example.com"
 
 # Static site path
 nginx_webroot: "/var/lib/matrix-nginx"
+
+coturn_shared_secret: "{{ 'your-secret-key' | password_hash('sha512', 'salt') }}"
+# Or generate randomly:
+# coturn_shared_secret: "{{ 24 | random_string | password_hash('sha512') }}"
+coturn_username: "matrix-turn"
+coturn_password: "{{ vault_coturn_password }}"

roles/common/tasks/main.yml

@@ -21,3 +21,10 @@
   loop:
     - "{{ synapse_data_dir }}"
     - "{{ nginx_webroot }}"
+
+# roles/matrix-synapse/tasks/main.yml
+- name: Restart Synapse to reload TURN config
+  container:
+    name: synapse
+    state: started
+    restart: yes

roles/matrix-synapse/tasks/main.yml

@@ -67,3 +67,28 @@
       - "{{ synapse_data_dir }}:/data"
     command: >
       -c /data/homeserver.yaml
+#----- Coturn + Synapse 
+- name: Run Coturn container (STUN/TURN server)
+  container:
+    name: coturn
+    image: coturn/coturn:latest
+    state: started
+    restart_policy: unless-stopped
+    pod: "{{ podman_pod_name }}"
+    env:
+      LISTENING_PORT: "3478"
+      ALTERNATE_LISTENING_PORT: "5349"
+      RELAY_ADDRESS: "{{ ansible_default_ipv4.address }}"  # or your server IP
+      EXTERNAL_IP: "{{ ansible_default_ipv4.address }}"
+      # Shared secret for dynamic credentials
+      TURNSERVER_STATIC_AUTH_SECRET: "{{ coturn_shared_secret }}"
+      # Enable TLS
+      TURNSERVER_TLS_LISTENING_PORT: "5349"
+      TURNSERVER_CERT: "/etc/turnserver/tls.crt"
+      TURNSERVER_PKEY: "/etc/turnserver/tls.key"
+      NO_AUTH_TIMESTAMPS: "true"
+      REALM: "{{ matrix_domain }}"
+    # Mount TLS certs (same as Nginx) if you want encrypted TURN (recommended)
+    volumes:
+      - "/var/lib/matrix-nginx/certbot/live/{{ matrix_domain }}:/etc/turnserver:ro"
+  register: coturn_cont

roles/matrix-synapse/templates/homeserver.yaml.j2

@@ -35,3 +35,24 @@ rc_flood_control:
 # Enable password login
 enable_registration: true
 enable_registration_without_verification: true
+
+
+## -- turn settings
+# Voice & Video Chat Settings
+media_store_path: /data/media_store
+max_image_pixels: 32000000  # 32MP max
+
+# TURN/STUN server config
+turn_uris:
+  - "turn:{{ matrix_domain }}:3478?transport=udp"
+  - "turn:{{ matrix_domain }}:3478?transport=tcp"
+  - "turns:{{ matrix_domain }}:5349?transport=tcp"  # encrypted TURN
+
+turn_shared_secret: "{{ coturn_shared_secret }}"
+turn_username: "{{ coturn_username }}"
+turn_password: "{{ coturn_password }}"
+turn_time_limit: 86400  # 24h (optional)
+turn_allow_guests: true  # allow non-Matrix users (e.g., web guests)
+
+# Optional: Enable call features
+enable_call_signalling: true

roles/nginx-proxy/templates/default.conf.j2

@@ -58,3 +58,36 @@ server {
         return 301 https://matrix-admin.example.com; # or proxy to a UI like SynapseAdmin
     }
 }
+
+#--- Coturn changes --- #
+
+# TURN over TLS (port 443) — proxied to Coturn's 5349
+# Only needed if you want TURN on 443 (avoids firewall issues)
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+upstream coturn_tls {
+    server 127.0.0.1:5349;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name {{ matrix_domain }};
+
+    # ... [existing TLS config] ...
+
+    # TURN over TLS (for UDP/TCP fallback on port 443)
+    location /turn {
+        proxy_pass https://coturn_tls;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_read_timeout 86400;
+    }
+
+    # Or simpler: proxy UDP via a dedicated TCP tunnel (advanced)
+    # For most cases, just expose 3478/5349 directly → no Nginx needed!
+}