Fix embedded-coturn relay-port overlap between Asterisk and Mattermost

Confirmed live on a box that retired the shared coturn service in favor
of each service running its own dedicated/embedded coturn permanently:
Mattermost's embedded-coturn fallback used relay range 49153-49352,
which overlaps Asterisk's embedded coturn range (49152-49252) by ~100
UDP ports. Both run network_mode: host, so with shared coturn out of
the picture this is the exact same collision CLAUDE.md documents as the
original, already-fixed-once bug that the shared coturn service was
built to solve in the first place — reintroduced here because
Mattermost's embedded-coturn fallback path apparently never got checked
against Asterisk's numbers when it was written.

Moved Mattermost's embedded relay range to 49253-49452 (same 200-port
width, now contiguous with and non-overlapping Asterisk's 49152-49252).
Updated the docker-compose command flags, the matching UFW rule, and
added a comment explaining the offset so it doesn't drift back into
collision — and noting the known residual gap this doesn't cover: two
Mattermost instances *both* falling back to embedded coturn at once
would still collide with each other on these same fixed numbers. Not
fixed here since it requires more than one Mattermost instance to be
running without shared coturn at the same time, which isn't this box's
situation; flagged in-code for whoever hits it.

Also made asterisk.sh's generated README port table stop unconditionally
claiming a TURN relay range it isn't actually publishing when the shared
coturn service (not this install's own container) is fronting TURN
instead — it now branches on USE_EMBEDDED_COTURN, which the function
already receives as a parameter.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/asterisk.sh

@@ -1447,9 +1447,11 @@ docker exec -it ${CONTAINER} easy-asterisk
 | 5061          | TCP      | SIP over TLS                     |
 | ${WEB_ADMIN_PORT_VAL}          | TCP      | Easy Asterisk web admin (auto-picked — see \`.env\`) |
 | 8088/8089     | TCP      | Asterisk HTTP/WS (ARI/AMI)       |
-| 3478          | UDP/TCP  | TURN/STUN (coturn)               |
 | 10000–20000   | UDP      | RTP media streams                |
-| 49152–49252   | UDP      | TURN relay media ports           |
+$( [[ "$USE_EMBEDDED_COTURN" == true ]] \
+    && echo "| 3478          | UDP/TCP  | TURN/STUN (this install's own dedicated coturn) |
+| 49152–49252   | UDP      | TURN relay media ports (dedicated coturn)  |" \
+    || echo "| See \`~/docker/coturn/.env\` | UDP/TCP | TURN/STUN — shared coturn service, not opened by this install |" )
 
 ## Data directories (all inside ${EA_DIR}/, included in backup)
 

services/mattermost.sh

@@ -415,6 +415,18 @@ networks:
     fi
     [ -n "$MM_SECRET" ] || MM_SECRET=$(generate_password 48)
 
+    # Listening port (3479, vs. Asterisk's embedded coturn on 3478) and relay
+    # range (49253-49452, vs. Asterisk's 49152-49252) are both deliberately
+    # offset from services/asterisk.sh's embedded coturn defaults. Confirmed
+    # live: an earlier version of this range (49153-49352) overlapped
+    # Asterisk's by ~100 ports — the exact bug the shared coturn service
+    # (services/coturn.sh) exists to avoid, reintroduced here because this
+    # is the no-shared-coturn fallback path. If more than one Mattermost
+    # instance ever falls back to embedded coturn at the same time, they'll
+    # collide with EACH OTHER on these same fixed numbers — not handled here
+    # (single-instance-without-shared-coturn is the case this fallback is
+    # actually for; install services/coturn.sh instead if you need more than
+    # one consumer without hand-managing per-instance port math).
     local _COTURN_SERVICE=""
     if [ "$USE_EMBEDDED_COTURN" = true ]; then
         _COTURN_SERVICE="
@@ -431,8 +443,8 @@ networks:
       - --use-auth-secret
       - --static-auth-secret=\${COTURN_SECRET}
       - --realm=\${MM_REALM:-localhost}
-      - --min-port=49153
-      - --max-port=49352
+      - --min-port=49253
+      - --max-port=49452
       - --no-tls
       - --no-dtls
       - --no-cli
@@ -532,7 +544,7 @@ EOF
         ufw allow "${CALLS_UDP_PORT}/udp" comment "Mattermost Calls RTC${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}"
         if [ "$USE_EMBEDDED_COTURN" = true ]; then
             ufw allow 3479/udp; ufw allow 3479/tcp
-            ufw allow 49153:49352/udp comment "Mattermost coturn relay"
+            ufw allow 49253:49452/udp comment "Mattermost coturn relay"
         fi
         # Shared coturn opens its own ports once, at its own install time.
     fi