Scope out Nextcloud Talk high-performance backend (signaling + coturn) #17

New issue

Open

opened 2026-07-08 16:08:55 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-07-08 16:08:55 +00:00

Collaborator

Signaling server (nextcloud/spreed-signaling, WebSocket-based) replaces Nextcloud's PHP fallback signaling — same-pattern addition as notify_push (new Caddy WSS route on both proxies, same trust-chain care).
TURN server (coturn) needed for media relay behind restrictive NATs; STUN is coturn again, no separate component.
coturn is the real lift: needs a wide public UDP port range (default 49152-65535) reachable from the internet, which Caddy cannot proxy — would need a direct OPNsense port-forward to a manager node. Docker Swarm's ingress routing mesh (which SNATs everything) is actively hostile to the NAT-mapping-per-session behavior TURN needs, so coturn would likely need host network mode pinned to one node rather than the routing-mesh pattern everything else in ccnet-nextcloud-swarm/ uses.

Net: treat as its own small project (new OPNsense port-forward rule, a host-mode coturn service, a pinned-node placement constraint) if/when Talk usage actually grows past small ad-hoc calls.

Deferred 2026-07-05 as part of the Nextcloud admin security cleanup (docs/next-steps.md item 8) — not expected to be used with more than 2-3 participants currently, so no urgency. Scoping already done so it's not a blind unknown next time it comes up: - Signaling server (nextcloud/spreed-signaling, WebSocket-based) replaces Nextcloud's PHP fallback signaling — same-pattern addition as notify_push (new Caddy WSS route on both proxies, same trust-chain care). - TURN server (coturn) needed for media relay behind restrictive NATs; STUN is coturn again, no separate component. - coturn is the real lift: needs a wide public UDP port range (default 49152-65535) reachable from the internet, which Caddy cannot proxy — would need a direct OPNsense port-forward to a manager node. Docker Swarm's ingress routing mesh (which SNATs everything) is actively hostile to the NAT-mapping-per-session behavior TURN needs, so coturn would likely need host network mode pinned to one node rather than the routing-mesh pattern everything else in ccnet-nextcloud-swarm/ uses. Net: treat as its own small project (new OPNsense port-forward rule, a host-mode coturn service, a pinned-node placement constraint) if/when Talk usage actually grows past small ad-hoc calls.

claude-bot added the

nextcloud

p:low

labels

2026-07-08 16:08:55 +00:00