[Feature Request] Short lived credentials for TURN - cloudflare

[irakhlin]

This feature request is to add a mechanism that would allow short-lived authentication to be used for the TURN server. I would imagine this would need to be extensible for different providers. The specific provider in mind here is cloudflare's current TURN server offering: https://developers.cloudflare.com/realtime/turn/generate-credentials/

There is a very healthy free tier available so it makes a good candidate for testing. Cloudflare does not allow creating long-lived credentials but does offer a very simple rest API endpoint that can be called with your credentials to return a username and credential based on the requested TTL.

I would imagine some backend process maybe using an expiring cache, would need to maintain a good known credential and be tasked with updating it.

Do you think this is a feature you would be willing to add?

[AlexxIT]

Go2rtc has two sources - echo (run some shell script) and expr (run script in expr format).
The script can pull up the actual credenchels and give them as a source.
The script is run each time the stream is not active.

[alexhopeoconnor]

Go2rtc has two sources - echo (run some shell script) and expr (run script in expr format). The script can pull up the actual credentials and give them as a source. The script is run each time the stream is not active.

Just to clarify — are you saying we can use an echo or expr script to dynamically generate the TURN username and credential fields in the webrtc.ice_servers section of the config?

For example, something like this:

go2rtc:
  webrtc:
    candidates:
      - turn:turn.example.com:3478?transport=udp
      - turn:turn.example.com:5349?transport=tcp
      - stun:turn.example.com:3478  # optional STUN
    ice_servers:
      - urls: ["stun:turn.example.com:3478"]
      - urls: ["turn:turn.example.com:3478?transport=udp"]
        username: "echo:./generate_turn_username.sh"
        credential: "echo:./generate_turn_password.sh"
      - urls: ["turn:turn.example.com:5349?transport=tcp"]
        username: "echo:./generate_turn_username.sh"
        credential: "echo:./generate_turn_password.sh"

Would something like that work? Or are the echo: and expr: dynamic source options only supported for stream URLs, not for TURN credentials?

[AlexxIT]

@alexhopeoconnor I was talking about webrtc client. You showing config examples for webrtc server.

I don't know you case, but you can change go2rtc.yaml with some external code/app and run go2rtc with this new config.
Or you can change config using API.