You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+3-17Lines changed: 3 additions & 17 deletions
Original file line number
Diff line number
Diff line change
@@ -23,23 +23,9 @@ where TURN credentials are usually negotiated in JavaScript.
23
23
24
24
## Description
25
25
26
-
By providing a cloud-based relay service, STUNner ensures that WebRTC peers can establish a media connection via TURN even when one or both sides is incapable of a direct P2P connection. This is the case, for instance, when media servers are deployed in a Kubernetes cluster.
27
-
28
-
As a gateway service,
29
-
STUNner opens external access to the Kubernetes cluster. STUNner implements a mechanism to control user access via long-term credentials that are provided as
30
-
part of the TURN protocol. It is expected that these credentials will be kept secret; if the
31
-
credentials are discovered, the TURN server could be used by unauthorized users or applications.
32
-
However, in web applications, ensuring this secrecy is typically impossible.
33
-
34
-
To address this problem, the STUNner authentication service provides a REST API that can be used to retrieve TURN
35
-
credentials to access STUNner. The service watches the running STUNner dataplane configuration(s)
36
-
from Kubernetes and automatically generates TURN credentials that will match the current
37
-
[authentication settings](https://github.com/l7mp/stunner/blob/main/doc/AUTH.md) for STUNner. The
38
-
REST API also allows to easily filter the returned TURN URIs to a selected set of STUNner Gateways:
39
-
it is possible to return all public TURN URIs per Kubernetes namespace, select a particular STUNner
40
-
Gateways within a namespace, or specify exactly which STUNner Gateway listener (say, TCP or UDP)
41
-
the returned credential should apply to. This allows to direct users to access the Kubernetes
42
-
cluster via a specific STUNner listener.
26
+
By providing a cloud-based relay service, STUNner ensures that WebRTC peers can establish a media connection via TURN even when one or both sides is incapable of a direct P2P connection. This is the case, for instance, when media servers are deployed in a Kubernetes cluster. As a gateway service, STUNner opens external access to the Kubernetes cluster. STUNner implements a mechanism to control user access via long-term credentials that are provided as part of the TURN protocol. It is expected that these credentials will be kept secret; if the credentials are discovered, the TURN server could be used by unauthorized users or applications. However, in web applications, ensuring this secrecy is typically impossible.
27
+
28
+
To address this problem, the STUNner authentication service provides a REST API that can be used to retrieve TURN credentials to access STUNner. The service watches the running STUNner dataplane configuration(s) from Kubernetes and automatically generates TURN credentials that will match the current [authentication settings](https://github.com/l7mp/stunner/blob/main/doc/AUTH.md) for STUNner. The REST API also allows to easily filter the returned TURN URIs to a selected set of STUNner Gateways: it is possible to return all public TURN URIs per Kubernetes namespace, select a particular STUNner Gateways within a namespace, or specify exactly which STUNner Gateway listener (say, TCP or UDP) the returned credential should apply to. This allows to direct users to access the Kubernetes cluster via a specific STUNner listener.
43
29
44
30
The main use of this service is by a WebRTC application server to generate an [ICE server
45
31
configuration](https://developer.mozilla.org/en-US/docs/Web/API/RTCIceServer) to be returned to
0 commit comments