Nextcloud Talk not connecting calls

[micmc]

@3246 Wow thankfully it works with external TURN, however it's pretty odd that it doesn't work with the Cloudron one. Apparently, there seems to be something that needs to be looked at more closely.

[nebulon]

@micmc unfortunately the TURN server on Cloudron cannot run on port 443, which is the most reliable one for webrtc, however nginx is already running there. There is some way to split traffic in nginx, but that is not part of the open source version, it needs some streams feature. So we had to fallback to other ports, which may or may not be blocked by a network. We may have to provide a feature to select which TURN server should be used for apps, internal or external, similar to how we deal with email sending.

[robi]

@nebulon adding stream support is done by enabling the module config.

See:
https://jitsi.github.io/handbook/docs/devops-guide/turn

Hence you can rev/fwd proxy anything as long as you can pass in the servername for nginx to pivot on.

FYI the stream_core_module is included in Ubuntu enginx-core packages.

P.S. It would be useful for @staff to be aware of the other modules for mail and other services that are available for multi-cloudron functionality.

[3246]

I'm playing with https://markus-blog.de/index.php/2020/11/20/how-to-run-nextcloud-talk-high-performance-backend-with-stun-turnserver-on-ubuntu-with-docker-compose/ on a Scaleway VM now to see how it works. It would be ace to get Cloudron's proxy to be able to proxy to the TURN/STUN server. Maybe my set up is too complicated (double NAT) and it works more smoothly to run Cloudron on a dedicated VM in a data centre somewhere

[micmc]

@nebulon said in Nextcloud Talk not connecting calls:

@micmc unfortunately the TURN server on Cloudron cannot run on port 443, which is the most reliable one for webrtc

Yeah, true I always forget this 'limitation' that TURN needs to run on port 443.

We may have to provide a feature to select which TURN server should be used for apps, internal or external, similar to how we deal with email sending.

While being at it that would be a great solution, and for several apps at the same time. +1

[3246]

@nebulon I just noticed that my custom TURN settings are being overwritten when the app is updated

stun_server
turn_server
TURN server schemes
turn_secret

Looks like signaling_secret is not affected.

I assume this is the expected behaviour but as a user who customises this, I would like my own settings to be honored, please

[3246]

@micmc said in Nextcloud Talk not connecting calls:

Yeah, true I always forget this 'limitation' that TURN needs to run on port 443.

Where does this come from or where you being sarcastic? (sorry, my translator is not enabled today)

I run my own TURN and STUN servers on port 3478. Maybe I am misunderstanding?

[nebulon]

@3246 this is not a real requirement but just depends on which network the clients are on. Some public wifis for example would block most ports besides the common ones. TURN on 443 is just a safe bet, since 443 is basically always open.

[eganonoa]

@3246 @girish mentioned public wifis. I think biggest reason for setting up turn on 443 is that very many (most?) academic and corporate IT systems block everything but 443 for ordinary users. So you'll never get a good connection if you have users accessing the internet there.

Cloudron does indeed overwrite the turn server setting in Nextcloud upon reboot/update of the app. Thankfully with Nextcoud you don't need to reboot to add the turnsever back in. So adding it works.

Sadly that's not the case with other apps - notably matrix - which means those apps will be limited in their videoconferencing capability until the ability to add an external turnserver is added to cloudron.

@girish from my perspective I don't think you need a per-app choice there. Just a global option which turnserver to use across apps. My sense is that people who need an external turnserver for one app (because of users in an academic/corporate setting or using Cloudflare, etc) will need it for them all.

• list item

[3246]

@girish @nebulon is there a way for me to hardcode my own TURN server / HPB? I have to manually check and update three Nextcloud sites every day, which is getting a bit tedious

Pretty please

[girish]

@3246 this is coming in 7.2 - https://forum.cloudron.io/topic/6655/what-s-coming-in-7-2 (the last bullet point)

[3246]

@girish said in Nextcloud Talk not connecting calls:

Amazing! Thank you

[Innky]

@doodlemania2

1. Do I need to install the turn server on the same server I installed the nextcloud

Or a different server?

My nextcloud works fine just that I can not call users on a different network.

How do I do this right, for I call users who are not on the same networks?

Thank you

[dmikolaj]

@girish where are we at with this solution in 7.2? My nextcloud talk won't work with the default turn settings, it only works when all the devices in the call are on the same local network. looks like my preconfigured by cloudron turn settings in nextcloud are on port 3478.

also if i overwrite my turn settings, where in your documentation are the settings located so i can restore to the cloudron defaults?

[joseph]

@dmikolaj is this spam?

[firmansi]

Actually I also still experience this issue, I can't make proper video call even after configure built-in TURN server, is there any port that should be set in firewall ?

[dmikolaj]

@joseph no this is not spam.

I tried both on your demo server and on my own test VPS to get nextcloud talk to work. The calls only work when both callers are on the same network which tells me that the turn server is not working. I also have a hetzner storage share nextcloud instance in which talk works out of the box in the same test scenario.

The hetzner nextcloud talk settings show their turn/stun server configured to port 443 and it works great.

I was wondering if I was doing something wrong, and have been looking through forums to try and see if there is a fix. So far it sounds like the built in cloudron turn server is not on port 443 which means it doesn't work reliably across all networks.

[nebulon]

It is correct, since Cloudron only has one server, where port 443 is occupied by the nginx reverse proxy, the turn server is not running on port 443. This can impact functionality depending on the local network setup. For this you can disable the usage of Cloudron's built-in turn server in nextcloud. See https://docs.cloudron.io/apps/#turn

Afterwards you can configure an alternative turn server, which works in your setup.

[firmansi]

@nebulon I guess the question (which not really provided in docs) is suggested port numbers that should be kept away from firewall

[nebulon]

@firmansi do you mean something like https://docs.cloudron.io/security/#inbound-ports or referring to something else?