SecureBitChat/securebit-chat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

v6.8.5: the relay password is no longer built into the app
CodeQL Analysis / Analyze CodeQL (push) Canceled after 0s
Details
Deploy Application / deploy (push) Canceled after 0s
Details
Mirror to Codeberg / mirror (push) Canceled after 0s
Details
Mirror to PrivacyGuides / mirror (push) Canceled after 0s
Details

Browse Source
This commit is contained in:
lockbitchat
2026-09-23 20:10:03 -04:00
parent f39e9022b7
commit 02380a7ecd
28 changed files with 365 additions and 345 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/ice-servers.prod.js
+6 -34
View File
@@ -1,5 +1,5 @@
// Production ICE override baked into the Fly.io image (no secrets — public STUN
// only). The Dockerfile copies this to config/ice-servers.js, which is otherwise
// only; the relay is added at runtime with a short-lived password). The Dockerfile copies this to config/ice-servers.js, which is otherwise
// git-ignored. Users who want a TURN relay can add one via "Advanced network
// settings"; to ship an operator TURN here, add it below (TURN credentials are
// visible to every browser, so rotate them if exposed).
@@ -12,37 +12,9 @@ window.SECUREBIT_ICE_SERVERS = [
// hostnames inside their WebRTC layer even though normal page DNS works, so they
// gather zero srflx/relay candidates and can't connect. Reaching the server by IP
// bypasses that. Harmless to other browsers.
{ urls: 'stun:144.172.96.126:3478' },
{
// SecureBit self-hosted coturn relay (turn.securebit.chat) — used only when
// direct P2P fails (strict NAT / STUN limits). Media stays E2E-encrypted over
// DTLS; the relay forwards only ciphertext. Multiple transports are offered so
// every browser finds one that works:
// - turn:3478?transport=udp — plain UDP, the most universally compatible
// transport (notably the one Safari reliably gathers relay candidates on).
// - turn:3478?transport=tcp — TCP fallback when UDP is blocked.
// - turns:443?transport=tcp — TURN over TLS on 443, bypasses restrictive
// firewalls that only allow HTTPS.
//
// The credential below is a long-lived token derived from the server's TURN
// REST API secret (static-auth-secret) — username is "<expiry-unix-ts>:label".
// Expiry 2147483647 = 2038-01-19 (max value coturn accepts; it parses the
// timestamp as int32). The master secret itself never leaves the server; only
// this derived username/credential pair is public (by design, like any
// browser-side TURN credential). To revoke/renew, rotate the server's
// static-auth-secret and re-issue with generate_turn_credentials.py.
urls: [
'turn:turn.securebit.chat:3478?transport=udp',
'turn:turn.securebit.chat:3478?transport=tcp',
// Raw-IP TURN relay — the DNS-bypass fallback that lets Safari (and any client
// whose WebRTC layer can't resolve the hostname) obtain a relay candidate.
// Plain turn: (no TLS) so no cert/hostname check is needed; the REST-API
// credential is host-independent, and relayed traffic is already E2E ciphertext.
'turn:144.172.96.126:3478?transport=udp',
'turn:144.172.96.126:3478?transport=tcp',
'turns:turn.securebit.chat:443?transport=tcp'
],
username: '2147483647:securebit',
credential: 'tNrw3h2p/+OE0uLMLVc+ech7T6o='
}
{ urls: 'stun:144.172.96.126:3478' }
// SecureBit's own TURN relay (turn.securebit.chat) is deliberately not listed
// here. It no longer has a built-in password: the app asks the site for one
// that expires after a day (POST /api/turn-credentials) and adds the relay to
// this list itself — see src/network/turnCredentials.js.
];