From 653229b6f0e774b36b121eeb52591f72465af837 Mon Sep 17 00:00:00 2001
From: grendervill <focuse@grandell.ru>
Date: Sat, 19 Sep 2026 20:38:24 +0300
Subject: [PATCH] =?UTF-8?q?fix(turn):=20=D0=B2=D0=BD=D0=B5=D1=88=D0=BD?=
 =?UTF-8?q?=D0=B8=D0=B9=20=D1=80=D0=B5=D0=BB=D0=B5=D0=B9=20=D0=B8=D1=81?=
 =?UTF-8?q?=D0=BF=D0=BE=D0=BB=D1=8C=D0=B7=D1=83=D0=B5=D1=82=20=D1=81=D1=82?=
 =?UTF-8?q?=D0=B0=D1=82=D0=B8=D1=87=D0=B5=D1=81=D0=BA=D0=B8=D0=B5=20=D0=BA?=
 =?UTF-8?q?=D1=80=D0=B5=D0=B4=D0=B5=D0=BD=D1=88=D0=B5=D0=BB=D1=8B=20(?=
 =?UTF-8?q?=D0=B2=20v1.9.7=20=D0=BD=D0=B5=D1=82=20=D0=BF=D0=BE=D0=BB=D1=8F?=
 =?UTF-8?q?=20secret)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/install.sh | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/deploy/install.sh b/deploy/install.sh
index e3f7387..6b38f92 100755
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -292,7 +292,13 @@ resolve_derived_values() {
     TURN_DOMAIN_RESOLVED="${TURN_DOMAIN_OVERRIDE:-turn.${DOMAIN}}"
     TURN_CERT_DIR="${TARGET_DIR}/certs"
     TURN_RELAY_HOST_RESOLVED="${TURN_RELAY_HOST}"
-    turn_shared_secret >/dev/null
+    TURN_RELAY_USER="${TURN_RELAY_USER:-glchat}"
+    tun_relay_password_from_env=""
+    if [ -f "$GLCHAT_ENV_FILE" ]; then
+        tun_relay_password_from_env="$(env_get TURN_RELAY_PASSWORD || true)"
+    fi
+    TURN_RELAY_PASSWORD="${TURN_RELAY_PASSWORD:-$tun_relay_password_from_env}"
+    [ -n "$TURN_RELAY_PASSWORD" ] || TURN_RELAY_PASSWORD="$(rand_base64 24)"
 
     disable_simulcast="true"
     if [ "${PROFILE_LIVEKIT_SIMULCAST:-0}" -gt 0 ] 2>/dev/null; then
@@ -329,7 +335,8 @@ resolve_derived_values() {
         PROFILE_LIVEKIT_DISABLE_SIMULCAST PROFILE_LIVEKIT_USE_EXTERNAL_IP \
         GLCHAT_DATA_DIR GLCHAT_CADDY_PROFILE GLCHAT_TURN_CERT_DIR \
         GLCHAT_APP_BIND GLCHAT_LIVEKIT_BIND TLS_ENABLED \
-        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED
+        TURN_DOMAIN_RESOLVED TURN_CERT_DIR TURN_RELAY_HOST_RESOLVED TURN_SECRET_RESOLVED \
+        TURN_RELAY_USER TURN_RELAY_PASSWORD
 }
 
 validate_inputs() {
@@ -658,7 +665,8 @@ TOTP_ENCRYPTION_KEY=@TOTP_ENCRYPTION_KEY@
 WEBHOOK_SECRET=@WEBHOOK_SECRET@
 LIVEKIT_API_KEY=@LIVEKIT_API_KEY@
 LIVEKIT_API_SECRET=@LIVEKIT_API_SECRET@
-TURN_SECRET=@TURN_SECRET@
+TURN_RELAY_USER=@TURN_RELAY_USER@
+TURN_RELAY_PASSWORD=@TURN_RELAY_PASSWORD@
 AGE_RECIPIENT=@AGE_RECIPIENT@
 
 # --- профиль производительности ---
@@ -888,10 +896,10 @@ ensure_swap() {
 render_turn_relay_servers() {
     [ -n "$TURN_RELAY_HOST" ] || return 0
     printf '  turn_servers:\n'
-    printf '    - host: %s\n      port: %s\n      protocol: udp\n      shared_secret: %s\n' \
-        "$TURN_RELAY_HOST" "$TURN_RELAY_PORT" "$TURN_SECRET_RESOLVED"
-    printf '    - host: %s\n      port: %s\n      protocol: tls\n      shared_secret: %s\n' \
-        "$TURN_RELAY_HOST" "$TURN_RELAY_TLS_PORT" "$TURN_SECRET_RESOLVED"
+    printf '    - host: %s\n      port: %s\n      protocol: udp\n      username: %s\n      credential: %s\n' \
+        "$TURN_RELAY_HOST" "$TURN_RELAY_PORT" "$TURN_RELAY_USER" "$TURN_RELAY_PASSWORD"
+    printf '    - host: %s\n      port: %s\n      protocol: tls\n      username: %s\n      credential: %s\n' \
+        "$TURN_RELAY_HOST" "$TURN_RELAY_TLS_PORT" "$TURN_RELAY_USER" "$TURN_RELAY_PASSWORD"
 }
 
 # turn_shared_secret — общий секрет для coturn (use-auth-secret) и LiveKit.