# Replace every CHANGE_ME value.
listening-port=3478
tls-listening-port=5349
realm=turn.example.com
server-name=turn.example.com
fingerprint

# Plainwire generates time-limited HMAC credentials from the same secret.
use-auth-secret
static-auth-secret=CHANGE_ME_MATCH_PLAINWIRE_TURN_SECRET

# If the host is behind one-to-one NAT, configure the mapping explicitly.
# external-ip=PUBLIC_IP/PRIVATE_IP

# Keep a deliberate relay range and match it in the firewall.
min-port=49152
max-port=65535

# TLS for turns: endpoints.
cert=/etc/letsencrypt/live/turn.example.com/fullchain.pem
pkey=/etc/letsencrypt/live/turn.example.com/privkey.pem

no-cli
no-tlsv1
no-tlsv1_1
stale-nonce

# Prevent obvious relay abuse toward local/private destinations.
no-multicast-peers
no-loopback-peers

# Log to stdout when containerized.
log-file=stdout
simple-log