Configure self-hosted STUN for remote WebRTC

docker-compose.yaml

@@ -49,7 +49,8 @@ services:
       DATABASE_URL: "postgresql+asyncpg://postgres:${POSTGRES_PASSWORD:-postgres}@postgres:5432/postgres"
       # 3030 = docker ui 宿主端口;3000 = 宿主机裸跑 npm run dev 时的端口
       CORS_ORIGINS: "http://localhost:3030,http://127.0.0.1:3030,http://localhost:3000,http://127.0.0.1:3000"
-      # WebRTC TURN(公网部署:设 PUBLIC_IP + TURN_SECRET,并 docker compose --profile remote up)
+      # WebRTC ICE(公网部署:STUN 指向同机 coturn,避免等待不可达的公共 STUN)
+      STUN_URL: "${STUN_URL:-stun:stun.l.google.com:19302}"
       TURN_URLS: "${TURN_URLS:-}"
       TURN_SECRET: "${TURN_SECRET:-}"
       S3_ENDPOINT_URL: "http://rustfs:9000"
@@ -118,7 +119,7 @@ services:
     networks: [app-network]
 
   # ---- 可选(profile: remote):WebRTC 公网穿透 ----
-  # 在项目根 .env 设置 PUBLIC_IP(云主机公网 IP)与 TURN_SECRET,与 backend TURN_SECRET 一致。
+  # 在项目根 .env 设置 PUBLIC_IP、PRIVATE_IP 与 TURN_SECRET。
   # 云安全组放行:UDP/TCP 3478,UDP 49152-49200。
   coturn:
     image: coturn/coturn:4.8.0
@@ -128,11 +129,12 @@ services:
       - -n
       - --log-file=stdout
       - --listening-port=3478
-      - --listening-ip=0.0.0.0
-      - --external-ip=${PUBLIC_IP:?set PUBLIC_IP in .env for coturn}
+      - --listening-ip=${PRIVATE_IP:?set PRIVATE_IP in .env for coturn}
+      - --relay-ip=${PRIVATE_IP:?set PRIVATE_IP in .env for coturn}
+      - --external-ip=${PUBLIC_IP:?set PUBLIC_IP in .env for coturn}/${PRIVATE_IP:?set PRIVATE_IP in .env for coturn}
       - --realm=ai-video
       - --use-auth-secret
-      - --static-auth-secret=${TURN_SECRET:-changeme}
+      - --static-auth-secret=${TURN_SECRET:?set TURN_SECRET in .env for coturn}
       - --min-port=49152
       - --max-port=49200
       - --no-cli