From 158df0d54527dc1fbf6161cdecfecd3395071729 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 13 Aug 2026 03:40:32 +0000
Subject: [PATCH] Fix embedded-coturn relay-port overlap between Asterisk and
 Mattermost
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Confirmed live on a box that retired the shared coturn service in favor
of each service running its own dedicated/embedded coturn permanently:
Mattermost's embedded-coturn fallback used relay range 49153-49352,
which overlaps Asterisk's embedded coturn range (49152-49252) by ~100
UDP ports. Both run network_mode: host, so with shared coturn out of
the picture this is the exact same collision CLAUDE.md documents as the
original, already-fixed-once bug that the shared coturn service was
built to solve in the first place — reintroduced here because
Mattermost's embedded-coturn fallback path apparently never got checked
against Asterisk's numbers when it was written.

Moved Mattermost's embedded relay range to 49253-49452 (same 200-port
width, now contiguous with and non-overlapping Asterisk's 49152-49252).
Updated the docker-compose command flags, the matching UFW rule, and
added a comment explaining the offset so it doesn't drift back into
collision — and noting the known residual gap this doesn't cover: two
Mattermost instances *both* falling back to embedded coturn at once
would still collide with each other on these same fixed numbers. Not
fixed here since it requires more than one Mattermost instance to be
running without shared coturn at the same time, which isn't this box's
situation; flagged in-code for whoever hits it.

Also made asterisk.sh's generated README port table stop unconditionally
claiming a TURN relay range it isn't actually publishing when the shared
coturn service (not this install's own container) is fronting TURN
instead — it now branches on USE_EMBEDDED_COTURN, which the function
already receives as a parameter.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn
---
 services/asterisk.sh   |  6 ++++--
 services/mattermost.sh | 18 +++++++++++++++---
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/services/asterisk.sh b/services/asterisk.sh
index 0cfa883..c0f04d1 100644
--- a/services/asterisk.sh
+++ b/services/asterisk.sh
@@ -1447,9 +1447,11 @@ docker exec -it ${CONTAINER} easy-asterisk
 | 5061          | TCP      | SIP over TLS                     |
 | ${WEB_ADMIN_PORT_VAL}          | TCP      | Easy Asterisk web admin (auto-picked — see \`.env\`) |
 | 8088/8089     | TCP      | Asterisk HTTP/WS (ARI/AMI)       |
-| 3478          | UDP/TCP  | TURN/STUN (coturn)               |
 | 10000–20000   | UDP      | RTP media streams                |
-| 49152–49252   | UDP      | TURN relay media ports           |
+$( [[ "$USE_EMBEDDED_COTURN" == true ]] \
+    && echo "| 3478          | UDP/TCP  | TURN/STUN (this install's own dedicated coturn) |
+| 49152–49252   | UDP      | TURN relay media ports (dedicated coturn)  |" \
+    || echo "| See \`~/docker/coturn/.env\` | UDP/TCP | TURN/STUN — shared coturn service, not opened by this install |" )
 
 ## Data directories (all inside ${EA_DIR}/, included in backup)
 
diff --git a/services/mattermost.sh b/services/mattermost.sh
index 7ccb3a6..063ab63 100644
--- a/services/mattermost.sh
+++ b/services/mattermost.sh
@@ -415,6 +415,18 @@ networks:
     fi
     [ -n "$MM_SECRET" ] || MM_SECRET=$(generate_password 48)
 
+    # Listening port (3479, vs. Asterisk's embedded coturn on 3478) and relay
+    # range (49253-49452, vs. Asterisk's 49152-49252) are both deliberately
+    # offset from services/asterisk.sh's embedded coturn defaults. Confirmed
+    # live: an earlier version of this range (49153-49352) overlapped
+    # Asterisk's by ~100 ports — the exact bug the shared coturn service
+    # (services/coturn.sh) exists to avoid, reintroduced here because this
+    # is the no-shared-coturn fallback path. If more than one Mattermost
+    # instance ever falls back to embedded coturn at the same time, they'll
+    # collide with EACH OTHER on these same fixed numbers — not handled here
+    # (single-instance-without-shared-coturn is the case this fallback is
+    # actually for; install services/coturn.sh instead if you need more than
+    # one consumer without hand-managing per-instance port math).
     local _COTURN_SERVICE=""
     if [ "$USE_EMBEDDED_COTURN" = true ]; then
         _COTURN_SERVICE="
@@ -431,8 +443,8 @@ networks:
       - --use-auth-secret
       - --static-auth-secret=\${COTURN_SECRET}
       - --realm=\${MM_REALM:-localhost}
-      - --min-port=49153
-      - --max-port=49352
+      - --min-port=49253
+      - --max-port=49452
       - --no-tls
       - --no-dtls
       - --no-cli
@@ -532,7 +544,7 @@ EOF
         ufw allow "${CALLS_UDP_PORT}/udp" comment "Mattermost Calls RTC${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}"
         if [ "$USE_EMBEDDED_COTURN" = true ]; then
             ufw allow 3479/udp; ufw allow 3479/tcp
-            ufw allow 49153:49352/udp comment "Mattermost coturn relay"
+            ufw allow 49253:49452/udp comment "Mattermost coturn relay"
         fi
         # Shared coturn opens its own ports once, at its own install time.
     fi