Allow STUN/TURN exposure over TCP/UDP to be controlled separately & disable STUN over UDP by default

roles/custom/matrix-coturn/defaults/main.yml

@@ -51,15 +51,32 @@ matrix_coturn_container_additional_volumes: []
 # A list of extra arguments to pass to the container
 matrix_coturn_container_extra_arguments: []
 
-# Controls whether the coturn container exposes its plain STUN port (tcp/3478 and udp/3478 in the container).
+# Controls whether the coturn container exposes its plain STUN port (tcp/3478 in the container) over TCP.
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3478"), or empty string to not expose.
-matrix_coturn_container_stun_plain_host_bind_port: "{{ '3478' if matrix_coturn_container_network != 'host' else '' }}"
+matrix_coturn_container_stun_plain_host_bind_port_tcp: "{{ '3478' if matrix_coturn_container_network != 'host' else '' }}"
 
-# Controls whether the coturn container exposes its TLS STUN port (tcp/5349 and udp/5349 in the container).
+# Controls whether the coturn container exposes its plain STUN port (udp/3478 in the container) over UDP.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:3478"), or empty string to not expose.
+#
+# This is not done by default to decrease the risk of DDoS amplification attacks.
+# See: https://stormwall.network/resources/blog/protect-against-ddos-based-on-stun-exploit
+matrix_coturn_container_stun_plain_host_bind_port_udp: ""
+
+# Controls whether the coturn container exposes its TLS STUN port (tcp/5349 in the container) over TCP.
 #
 # Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:5349"), or empty string to not expose.
-matrix_coturn_container_stun_tls_host_bind_port: "{{ '5349' if matrix_coturn_container_network != 'host' else '' }}"
+matrix_coturn_container_stun_tls_host_bind_port_tcp: "{{ '5349' if matrix_coturn_container_network != 'host' else '' }}"
+
+# Controls whether the coturn container exposes its TLS STUN port (udp/5349 in the container) over UDP.
+#
+# Takes an "<ip>:<port>" or "<port>" value (e.g. "127.0.0.1:5349"), or empty string to not expose.
+#
+# This is enabled by default, unlike `matrix_coturn_container_stun_plain_host_bind_port_udp`,
+# because the risk of DDoS amplification attacks is lower for TLS
+# due to the handshake requiring two-way authentication and being generally more expensive.
+matrix_coturn_container_stun_tls_host_bind_port_udp: "{{ '5349' if matrix_coturn_container_network != 'host' else '' }}"
 
 # Controls whether the coturn container exposes its TURN UDP port range and which interface to do it on.
 #

roles/custom/matrix-coturn/tasks/validate_config.yml

@@ -8,6 +8,8 @@
   when: "item.old in vars"
   with_items:
     - {'old': 'matrix_coturn_docker_network', 'new': 'matrix_coturn_container_network'}
+    - {'old': 'matrix_coturn_container_stun_plain_host_bind_port', 'new': 'superseded by matrix_coturn_container_stun_plain_host_bind_port_tcp and matrix_coturn_container_stun_plain_host_bind_port_udp'}
+    - {'old': 'matrix_coturn_container_stun_tls_host_bind_port', 'new': 'superseded by matrix_coturn_container_stun_tls_host_bind_port_tcp and matrix_coturn_container_stun_tls_host_bind_port_udp'}
 
 - name: Fail if matrix_coturn_authentication_method is invalid
   ansible.builtin.fail:

roles/custom/matrix-coturn/templates/systemd/matrix-coturn.service.j2

@@ -24,13 +24,17 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \
 			--read-only \
 			--tmpfs=/var/tmp:rw,noexec,nosuid,size=100m \
 			--network={{ matrix_coturn_container_network }} \
-			{% if matrix_coturn_container_stun_plain_host_bind_port != '' %}
-			-p {{ matrix_coturn_container_stun_plain_host_bind_port }}:3478 \
-			-p {{ matrix_coturn_container_stun_plain_host_bind_port }}:3478/udp \
+			{% if matrix_coturn_container_stun_plain_host_bind_port_tcp != '' %}
+			-p {{ matrix_coturn_container_stun_plain_host_bind_port_tcp }}:3478 \
 			{% endif %}
-			{% if matrix_coturn_container_stun_tls_host_bind_port != '' %}
-			-p {{ matrix_coturn_container_stun_tls_host_bind_port }}:5349 \
-			-p {{ matrix_coturn_container_stun_tls_host_bind_port }}:5349/udp \
+			{% if matrix_coturn_container_stun_plain_host_bind_port_udp != '' %}
+			-p {{ matrix_coturn_container_stun_plain_host_bind_port_udp }}:3478/udp \
+			{% endif %}
+			{% if matrix_coturn_container_stun_tls_host_bind_port_tcp != '' %}
+			-p {{ matrix_coturn_container_stun_tls_host_bind_port_tcp }}:5349 \
+			{% endif %}
+			{% if matrix_coturn_container_stun_tls_host_bind_port_udp != '' %}
+			-p {{ matrix_coturn_container_stun_tls_host_bind_port_udp }}:5349/udp \
 			{% endif %}
 			{% if matrix_coturn_container_turn_range_listen_interface is not in [none, 'none'] %}
 			-p {{ matrix_coturn_container_turn_range_listen_interface }}{{ ':' if matrix_coturn_container_turn_range_listen_interface else '' }}{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}:{{ matrix_coturn_turn_udp_min_port }}-{{ matrix_coturn_turn_udp_max_port }}/udp \