- Shipped
- August 26, 2026 at 4:18 AM UTC
- Author
- kamo
- Commit
- cfc176c
The browser SIP path built its peer connection with one hardcoded public STUN /api/voip/turn/credentials for as long as that endpoint has existed — TurnController's own javadoc notes the SIP credential payload "never carried TURN". coturn has been running for 16 days with its secret configured and VOIPService already wired to it; the only missing piece was the browser asking. STUN only tells a peer its public address. It cannot get media through a symmetric NAT, a carrier CGNAT, or a VPN that blocks inbound UDP — those members have no working media path at all, and report it as a dropped call, which after the fact is indistinguishable from hitting refresh. Strictly additive: relay is appended after STUN and ICE prefers host > srflx > relay, so anyone whose media already works keeps the exact path they had. Every failure degrades to STUN-only rather than throwing, because this runs inside SIP registration where an exception costs the member their line. Not wired for RingCentral, deliberately and with the reason recorded in the adapter: web-phone v2 builds its own RTCPeerConnection from sipInfo.stunServers and exposes no ICE option, and RingCentral runs its own SBC media infrastructure. Teams/ACS owns its media stack likewise.