Fix coturn "Unknown argument:" error and noisy interface binding

Replace the coturn image's fragile eval-based entrypoint with a robust
wrapper that handles external IP detection without word-splitting issues.
The image's `exec $(eval "echo $@")` produces empty tokens when
DETECT_EXTERNAL_IP's DNS lookup fails → "ERROR: CONFIG: Unknown argument:"

Also add --listening-ip=0.0.0.0 so coturn binds a single wildcard address
instead of enumerating every host interface (reduces log noise).

https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX

docker-compose.yml

@@ -85,12 +85,19 @@ services:
     # The coturn image runs as nobody:nogroup by default, which cannot
     # create /var/run/turnserver.pid. Run as root to avoid this.
     user: root
+    # Custom entrypoint bypasses the coturn image's fragile eval-based
+    # entrypoint which causes "Unknown argument:" errors when IP detection
+    # returns empty. Our wrapper handles detection robustly.
+    entrypoint: ["/coturn-entrypoint.sh"]
+    volumes:
+      - ./docker/coturn-entrypoint.sh:/coturn-entrypoint.sh:ro
     environment:
-      # Image-native external IP detection (adds --external-ip automatically)
-      - DETECT_EXTERNAL_IP=${DETECT_EXTERNAL_IP:-yes}
+      # Passed to our entrypoint for --external-ip. Auto-detected if empty.
+      - PUBLIC_IP=${PUBLIC_IP:-}
     command:
       - -n
       - --listening-port=${TURN_PORT:-3478}
+      - --listening-ip=0.0.0.0
       - --fingerprint
       - --lt-cred-mech
       - --user=${TURN_USERNAME:-easyasterisk}:${TURN_PASSWORD:-changeme}

docker/coturn-entrypoint.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+# ================================================================
+# Robust coturn entrypoint
+#
+# The coturn/coturn Docker image's native entrypoint uses:
+#   exec $(eval "echo $@")
+# which is fragile — if DETECT_EXTERNAL_IP's DNS lookup returns empty,
+# the eval produces an empty token → "ERROR: CONFIG: Unknown argument:"
+#
+# This wrapper reuses the image's detect-external-ip script but avoids
+# the eval word-splitting issue. If detection fails, we simply omit
+# --external-ip rather than passing a blank argument.
+# ================================================================
+
+# Use explicit PUBLIC_IP if provided, otherwise auto-detect
+if [ -z "$PUBLIC_IP" ]; then
+    PUBLIC_IP=$(detect-external-ip 2>/dev/null || true)
+fi
+
+# Only add --external-ip if we actually have an IP
+EXTERNAL_IP_ARG=""
+if [ -n "$PUBLIC_IP" ]; then
+    EXTERNAL_IP_ARG="--external-ip=$PUBLIC_IP"
+fi
+
+exec turnserver "$@" $EXTERNAL_IP_ARG