wirecore / scripts / setup-turn-server.sh

#!/bin/bash
#
# Wirecore TURN Server Setup Script
# Run this on Tabertron to install and configure coturn
#
# Usage: sudo bash setup-turn-server.sh
#

set -e  # Exit on error

echo "🔗 Wirecore TURN Server Setup"
echo "=============================="
echo ""

# Check if running as root
if [ "$EUID" -ne 0 ]; then
  echo "❌ Please run as root: sudo bash setup-turn-server.sh"
  exit 1
fi

# Get the directory where this script is located
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"

# Step 1: Install coturn
echo "📦 Installing coturn..."
apt update
apt install -y coturn

# Step 2: Enable coturn
echo "✅ Enabling coturn service..."
sed -i 's/#TURNSERVER_ENABLED=1/TURNSERVER_ENABLED=1/' /etc/default/coturn

# Step 3: Get public IP automatically
echo "🌐 Detecting public IP..."
PUBLIC_IP=$(curl -4 -s ifconfig.me)
if [ -z "$PUBLIC_IP" ]; then
  echo "⚠️  Could not detect public IP automatically"
  echo "Please enter your Tabertron public IP:"
  read PUBLIC_IP
fi
echo "Using IP: $PUBLIC_IP"

# Step 4: Generate random password
TURN_PASSWORD="wirecore$(openssl rand -hex 8)"
echo "🔐 Generated TURN password: $TURN_PASSWORD"
echo "    (Save this - you'll need it for Wirecore config)"

# Step 5: Update config file with IP and password
echo "📝 Creating turnserver.conf..."
sed -e "s/CHANGE_ME_TO_YOUR_PUBLIC_IP/$PUBLIC_IP/g" \
    -e "s/wirecore2026secure/$TURN_PASSWORD/g" \
    "$SCRIPT_DIR/turnserver.conf" > /tmp/turnserver.conf.tmp

# Step 6: Backup existing config if it exists
if [ -f /etc/turnserver.conf ]; then
  echo "💾 Backing up existing config to /etc/turnserver.conf.backup"
  cp /etc/turnserver.conf /etc/turnserver.conf.backup
fi

# Step 7: Copy config to system location
echo "📋 Installing config to /etc/turnserver.conf"
cp /tmp/turnserver.conf.tmp /etc/turnserver.conf
chmod 644 /etc/turnserver.conf

# Step 8: Create log directory
echo "📁 Creating log directory..."
mkdir -p /var/log/turnserver
chown turnserver:turnserver /var/log/turnserver 2>/dev/null || true

# Step 9: Configure firewall
echo "🔥 Configuring firewall..."
if command -v ufw &> /dev/null; then
  echo "   Using UFW..."
  ufw allow 3478/tcp comment 'TURN TCP'
  ufw allow 3478/udp comment 'TURN UDP'
  ufw allow 5349/tcp comment 'TURN TLS'
  ufw allow 49152:65535/udp comment 'TURN relay range'
  echo "   ✅ UFW rules added"
elif command -v iptables &> /dev/null; then
  echo "   Using iptables..."
  iptables -A INPUT -p tcp --dport 3478 -j ACCEPT -m comment --comment "TURN TCP"
  iptables -A INPUT -p udp --dport 3478 -j ACCEPT -m comment --comment "TURN UDP"
  iptables -A INPUT -p tcp --dport 5349 -j ACCEPT -m comment --comment "TURN TLS"
  iptables -A INPUT -p udp --dport 49152:65535 -j ACCEPT -m comment --comment "TURN relay"

  # Save rules
  if [ -d /etc/iptables ]; then
    iptables-save > /etc/iptables/rules.v4
  fi
  echo "   ✅ iptables rules added"
else
  echo "   ⚠️  No firewall detected - you may need to manually open ports"
fi

# Step 10: Start and enable coturn
echo "🚀 Starting coturn service..."
systemctl daemon-reload
systemctl enable coturn
systemctl restart coturn

# Step 11: Wait and check status
sleep 2
if systemctl is-active --quiet coturn; then
  echo ""
  echo "✅ TURN server is running!"
  echo ""
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "📝 TURN Server Details:"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo "Server IP:     $PUBLIC_IP"
  echo "TURN Port:     3478 (UDP/TCP)"
  echo "TURN TLS Port: 5349 (TCP)"
  echo "Username:      wirecore"
  echo "Password:      $TURN_PASSWORD"
  echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
  echo ""
  echo "📋 Next Steps:"
  echo "1. Update Wirecore config in public/app.js:"
  echo "   - Uncomment lines 124-133"
  echo "   - Change YOUR_TABERTRON_IP to: $PUBLIC_IP"
  echo "   - Change YourPassword123 to: $TURN_PASSWORD"
  echo ""
  echo "2. Or run this command to auto-update:"
  echo "   cd $(dirname $SCRIPT_DIR)"
  echo "   bash update-turn-config.sh $PUBLIC_IP $TURN_PASSWORD"
  echo ""
  echo "3. Check logs with:"
  echo "   sudo tail -f /var/log/turnserver/turnserver.log"
  echo ""
  echo "4. Check service status:"
  echo "   sudo systemctl status coturn"
  echo ""
else
  echo ""
  echo "❌ Failed to start coturn"
  echo "Check logs: sudo journalctl -u coturn -n 50"
  exit 1
fi

# Save credentials to file for reference
echo "💾 Saving credentials to turnserver-credentials.txt"
cat > "$SCRIPT_DIR/turnserver-credentials.txt" << EOF
TURN Server Credentials for Wirecore
=====================================

Server IP:     $PUBLIC_IP
TURN Port:     3478 (UDP/TCP)
TURN TLS Port: 5349 (TCP)
Username:      wirecore
Password:      $TURN_PASSWORD

Firewall Ports Opened:
- 3478/tcp (TURN)
- 3478/udp (TURN)
- 5349/tcp (TURN TLS)
- 49152-65535/udp (TURN relay range)

Config file: /etc/turnserver.conf
Log file:    /var/log/turnserver/turnserver.log

Installation date: $(date)
EOF

chmod 600 "$SCRIPT_DIR/turnserver-credentials.txt"

echo "✅ Setup complete!"