v6.8.4: the relay password now changes every day

deploy/nginx.conf

@@ -4,6 +4,14 @@
 # long-immutable cache for hashed/static assets, security headers, honest 404s.
 
 worker_processes auto;
+
+# njs runs the TURN credential endpoint (deploy/turn-credentials.js). The official
+# nginx image ships the module; it only has to be loaded.
+load_module modules/ngx_http_js_module.so;
+# nginx clears the environment of its workers; this keeps the coturn REST-API
+# secret (a Fly secret) visible to that script and to nothing else.
+env TURN_SECRET;
+
 events { worker_connections 1024; }
 
 http {
@@ -69,6 +77,8 @@ http {
         # one-year immutable cache, which would freeze a sitemap for a year.
         ~^/robots\.txt$          "public, max-age=3600";
         ~^/sitemap\.xml$         "public, max-age=3600";
+        # Relay credentials are minted per request and must never be stored.
+        ~^/api/                  "no-store";
     }
 
     # CDN-Cache-Control is read by Cloudflare (and other CDNs) *independently* of the
@@ -88,8 +98,28 @@ http {
         ~^/config/ice-servers\.js$ "no-store";
         ~^/dist/                 "no-store";
         ~^/src/i18n/             "no-store";
+        ~^/api/                  "no-store";
     }
 
+    # ---- TURN credential endpoint ----
+    js_path   /etc/nginx/njs/;
+    js_import turncreds from turn-credentials.js;
+
+    # Rate-limit by the real client. Behind Cloudflare every request arrives from
+    # an edge address, so keying on the connection would throttle unrelated users
+    # together; CF-Connecting-IP is the visitor. Requests that reach Fly directly
+    # carry no such header and fall back to Fly's own client address. A caller who
+    # forges the header can dodge the per-client limit, which is why there is
+    # also a global ceiling below — and coturn has its own quotas behind both.
+    map $http_cf_connecting_ip $turn_client {
+        ""      $http_fly_client_ip;
+        default $http_cf_connecting_ip;
+    }
+    # A client needs one credential per day plus a few for reloads and new tabs.
+    limit_req_zone $turn_client zone=turn_per_client:2m rate=10r/m;
+    limit_req_zone $server_name zone=turn_global:1m     rate=20r/s;
+    limit_req_status 429;
+
     server {
         listen      8080 default_server;
         listen      [::]:8080 default_server;
@@ -113,6 +143,13 @@ http {
         add_header CDN-Cache-Control        $sb_cdn_cache                      always;
         add_header Service-Worker-Allowed   "/"                                always;
 
+        # Short-lived TURN relay credentials. See deploy/turn-credentials.js.
+        location = /api/turn-credentials {
+            limit_req zone=turn_per_client burst=10 nodelay;
+            limit_req zone=turn_global     burst=100 nodelay;
+            js_content turncreds.handle;
+        }
+
         # Real asset files must return 404 when missing — never fall back to the
         # HTML shell, which would be served with the wrong content type and break
         # module/script loading (e.g. a missing config/ice-servers.js).