values.yaml

---
replicas: 1

# -- different name for the helm release
nameOverride: ""

service:
  # -- The type of service to deploy for routing Coturn traffic.
  #   ClusterIP: Recommended for DaemonSet configurations. This will create a
  #              standard Kubernetes service for Coturn within the cluster.
  #              No external networking will be configured as the DaemonSet
  #              will handle binding to each Node's host networking
  #
  #   NodePort:  Recommended for Deployment configurations. This will open
  #              TURN ports on every node and route traffic on these ports to
  #              the Coturn pods. You will need to make sure your cloud
  #              provider supports the cluster config setting,
  #              apiserver.service-node-port-range, as this range must contain
  #              the ports defined above for the service to be created.
  #
  #   LoadBalancer: This was what was originally set for this chart in the
  #                 upstream of this fork, but with no details
  type: ClusterIP
  # -- I don't actually know what this is 🤔 open a PR if you know
  #    was originally "Local"
  externalTrafficPolicy: ""

image:
  # -- container registry and repo for coturn docker image
  repository: "coturn/coturn"
  # -- docker tag for coturn server
  tag: ""
  # -- image pull policy, set to Always if using image.tag: latest
  pullPolicy: IfNotPresent

# -- ref: kubernetes.io/docs/concepts/configuration/manage-resources-containers
resources: {}

# -- Coturn specific labels
labels:
  component: coturn

certificate:
  # -- Enables auto issuing certificates over cert-manager certificates
  # https://cert-manager.io/docs/concepts/certificate/
  enabled: false
  # -- name of secret to create for ssl cert
  secret: "turn-tls"
  # -- name of cert-manager issuer to use for cert generation.
  # change to production issuer when you're stable
  issuerName: "letsencrypt-staging"

externalDatabase:
  # -- enables the use of postgresql instead of the default sqlite
  # to use the bundled subchart, enable this, and postgresql.enable
  enabled: false
  # -- Currently postgresql and mysql are supported.
  type: "postgresql"
  # -- required if externalDatabase.enabled: true and postgresql.enabled: false
  hostname: ""
  # -- username for database, ignored if existingSecret is passed in
  username: ""
  # -- password for database, ignored if existingSecret is passed in
  password: ""
  # -- database to create, ignored if existingSecret is passed in
  database: ""
  # -- name of existing Secret to use for postgresql credentials
  existingSecret: ""
  # Names of the keys in existing secret to use for PostgreSQL credentials
  secretKeys:
    # -- key in existing Secret to use for the db user
    username: ""
    # -- key in existing Secret to use for db user's password
    password: ""
    # -- key in existing Secret to use for the database name
    database: ""
    # -- key in existing Secret to use for the db's hostname
    hostname: ""

# PostgreSQL chart configuration
# see: https://github.com/bitnami/charts/tree/main/bitnami/postgresql
postgresql:
  # -- enables bitnami postgresql subchart, you can disable to use external db
  enabled: false
  global:
    postgresql:
      # global.postgresql.auth overrides postgresql.auth
      auth:
        # -- username for database, ignored if existingSecret is passed in
        username: "coturn"
        # -- password for db, autogenerated if empty & existingSecret empty
        password: ""
        # -- database to create, ignored if existingSecret is passed in
        database: "coturn"
        # -- name of existing Secret to use for postgresql credentials
        existingSecret: ""
        # Names of the keys in existing secret to use for PostgreSQL credentials
        # all of these are ignored if existingSecret is empty
        secretKeys:
          # -- key in existingSecret for database to create
          hostname: "hostname"
          # -- key in existingSecret for database to create
          database: "database"
          # -- key in exsiting Secret to use for the coturn user
          username: "username"
          # -- key in existing Secret to use for postgres admin user's password
          adminPasswordKey: "postgresPassword"
          # -- key in existing Secret to use for coturn user's password
          userPasswordKey: "password"
  primary:
    initdb:
      # -- ConfigMap with scripts to be run at first boot
      scriptsConfigMap: ""

# MySQL chart configuration
# see: https://github.com/bitnami/charts/tree/main/bitnami/mysql
mysql:
  # -- enables bitnami mysql subchart, you can disable to use external db
  enabled: false
  auth:
    # -- username for database, ignored if existingSecret is passed in
    username: "coturn"
    # -- password for db, autogenerated if empty & existingSecret empty
    password: ""
    # -- database to create, ignored if existingSecret is passed in
    database: "coturn"
    # -- Use existing secret for password details.
    # The secret has to contain the keys mysql-root-password, mysql-replication-password and mysql-password
    existingSecret: ""
    # Names of the keys in existing secret to use for MySQL credentials
    secretKeys:
      # -- key in exsiting Secret to use for the coturn user
      username: "username"
      # -- key in existing Secret to use for coturn user's password
      password: "password"
  # -- ConfigMap with the initdb scripts (Note: Overrides initdbScripts)
  initdbScriptsConfigMap: initdb-scripts-config

# most coturn config parameters that you really need
coturn:
  # --  hostname for the coturn server realm
  realm: "turn.example.com"

  auth:
    # -- username for the main user of the turn server
    username: "coturn"
    # -- password for the main user of the turn server
    password: ""
    # -- existing secret with keys username/password for coturn
    existingSecret: ""
    secretKeys:
      # -- key in existing secret for turn server user
      username: username
      # -- key in existing secret for turn server user's password
      password: password

  # -- coturn's listening IP address
  listeningIP: "0.0.0.0"

  ports:
    # -- minimum ephemeral port for coturn
    min: 49152
    # -- maximum ephemeral port for coturn
    max: 65535
    # -- insecure listening port
    listening: 3478
    # -- secure listening port
    tlsListening: 5349

  # -- set the logfile. Defaults to stdout for use with kubectl logs
  logFile: "stdout"

  # -- extra configuration for turnserver.conf
  extraTurnserverConfiguration: |
    verbose

  initContainer:
    image:
      # -- registry and repository for init container config generator image
      repository: mikefarah/yq
      # -- tag for init container config generator image
      tag: latest

# k8s pod security context:
# https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
podSecurityContext:
  # -- Enables Pod Security Context
  enabled: true
  # -- for all Containers in the Pod, all processes run as non-root
  runAsNonRoot: true
  # -- for all Containers in the Pod, all processes run w/ this userID
  runAsUser: 1000
  # -- for all Containers in the Pod, all processes run w/ this GroupID
  runAsGroup: 1000
  # -- all processes of the container are also part of the supplementary groupID
  fsGroup: 1000
  seccompProfile:
    # --  Filter a process's system calls
    type: "RuntimeDefault"

containerSecurityContext:
  # -- Enables Security Context
  enabled: true
  capabilities:
    # -- linux cabilities to allow for the coturn k8s pod
    add: ["NET_BIND_SERVICE"]
    # -- linux cabilities to disallow for the coturn k8s pod
    drop: ["ALL"]
  # -- allow modificatin to root filesystem
  readOnlyRootFilesystem: false
  # -- allow priviledged access
  allowPrivilegeEscalation: false