Working on public server

.env.sample

@@ -1,4 +1,5 @@
 TYPE=lasuite-meet
+COMPOSE_FILE=compose.yml:compose.turn.yml
 
 DOMAIN=lasuite-meet.example.com
 ## LiveKit domain — separate domain for WebSocket signaling
@@ -61,10 +62,31 @@ OIDC_AUTH_REQUEST_EXTRA_PARAMS='{"acr_values": "eidas1"}'
 ##############################################################################
 # LIVEKIT
 ##############################################################################
-# note: this is an identifier, but does not need to be secret
+# note: this is an identifier, not a secret
 LIVEKIT_API_KEY=meet
+## The server's public IP address — LiveKit advertises this in ICE candidates
+## so WebRTC clients can reach the media ports (7881/7882).
+## Required: STUN-based detection does not work reliably inside Docker.
+LIVEKIT_NODE_IP=
+## Force clients to use TCP for media transport (default: false)
+## Enable in environments where UDP NAT traversal is unreliable
+#LIVEKIT_FORCE_TCP=false
 #ALLOW_UNREGISTERED_ROOMS=False
 
+##############################################################################
+# TURN SERVER (enabled by default — improves connectivity for restrictive NATs)
+##############################################################################
+## LiveKit's built-in TURN server helps users behind CGNAT/symmetric NAT.
+## Enabled by default via COMPOSE_FILE and LIVEKIT_TURN_ENABLED.
+## To disable TURN, remove compose.turn.yml from COMPOSE_FILE and set:
+#LIVEKIT_TURN_ENABLED=false
+## TURN domain — must resolve to this server's IP.
+## Defaults to LIVEKIT_DOMAIN, which works for TURN/UDP setups.
+#TURN_DOMAIN=turn.example.com
+## TURN/UDP port (default: 443). Recommended because UDP 443 is rarely
+## blocked and doesn't conflict with Traefik's TCP 443.
+#TURN_UDP_PORT=443
+
 ##############################################################################
 # LOGGING (defaults to INFO, uncomment to override)
 ##############################################################################