From 0ff2c788d69aa1786990f5dbb82fc91b3c5d47af Mon Sep 17 00:00:00 2001
From: Russell Ballestrini <russell.ballestrini@gmail.com>
Date: Wed, 27 May 2026 17:10:29 -0400
Subject: [PATCH] chat.html: add proxy.uncloseai.com TURN to iceServers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

with coturn live on proxy.uncloseai.com (proxy.unturf.com:22ccf93),
ICE now offers a relay candidate path on every connection. peers
behind symmetric NAT or strict firewalls fall back to TURN instead
of failing the connection.

static creds zebra:7a4a2b1c8d9e6f5a — public by design (a static
page can't hide them); rate-limited by coturn quotas, not secrecy.
google stun stays as fallback if our stun is unreachable.
---
 web/chat.html | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/web/chat.html b/web/chat.html
index 4070142..fc4a821 100644
--- a/web/chat.html
+++ b/web/chat.html
@@ -385,7 +385,18 @@ const PBKDF2_ITER = 600000;
 const LOOPBACK = new URLSearchParams(location.search).has('loopback');
 
 const RTC_CONFIG = {
-  iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
+  iceServers: [
+    /* our STUN/TURN on proxy.uncloseai.com — coturn deployed via
+     * git.unturf.com/engineering/unturf/proxy.unturf.com.
+     * credentials are public by design (baked into a static page);
+     * rate-limited via coturn quotas, not via secrecy.            */
+    { urls: ['stun:proxy.uncloseai.com:3478', 'stun:stun.l.google.com:19302'] },
+    {
+      urls: 'turn:proxy.uncloseai.com:3478',
+      username: 'zebra',
+      credential: '7a4a2b1c8d9e6f5a'
+    }
+  ]
 };
 
 /* ============================================================== *