Turn with external tls termination

[lukasIO]

fixes #71

edit: Unfortunately I'm lacking a proper test setup to test if it is actually working as intended :\

[davidzhao]

Great work @lukasIO! It'd be good to validate if this is indeed working before we merge. I'll try it in a day or two.

[bekriebel]

@davidzhao Would it still be possible to get this into the next release? I think it may help some of my use cases as well.

In addition to this, is it feasible to change the Listen calls to listen on all endpoints (Listen("tcp", ":PORT", Listen("udp", ":PORT" instead of tcp4/udp4)? I know TURN over ipv6 isn't implemented yet, but Fly uses all ipv6 internally and terminates ipv6 at the edges - so I need to be able to have it listen on the ipv6 interface just so I can have the edges proxy to the endpoint.

[davidzhao]

@bekriebel I haven't gotten a chance to test it yet. Lmk if you have. I'd like to merge it in, but would just want to ensure it actually does what we are looking for.

re: IPv6, let's discuss separately about that. We have an item on our backlog for it.

[bekriebel]

@bekriebel I haven't gotten a chance to test it yet. Lmk if you have. I'd like to merge it in, but would just want to ensure it actually does what we are looking for.

I'll try to test it out tomorrow. I think I have an environment where I can test it pretty easily.

re: IPv6, let's discuss separately about that. We have an item on our backlog for it.

Sounds good!

[bekriebel]

@davidzhao This does seem to work exactly as expected. With this, I can move the TLS termination to a proxy and pass the TCP connection to livekit with no certificates in place.

I tested with HAProxy and it passes the connection tester on Chrome without issue. I do get an error connecting to TURN with the checker on Firefox, however that issue also occurs if I put a proxy in front of the TLS enabled version of LiveKit TURN and don't terminate TLS with HAProxy as well. This seems to be some issue with HAProxy & Firefox when doing TCP proxying and doesn't seem to have anything to do with where TLS is terminated.

This gets a 👍 from me.

[davidzhao]

Thanks for confirming @bekriebel ! Merging it!