From aa98516d3ec91a360b5b096c9f3f40b84e4125e4 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Fri, 7 Aug 2026 22:45:52 +0200
Subject: [PATCH] SFU health: expose ice_servers for WebRTC clients (M2).

Include coturn turn_host credentials from lab config alongside public STUN.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 examples/sfu/README.md | 17 +++++++++++++----
 public/health.php      | 18 ++++++++++++++++++
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/examples/sfu/README.md b/examples/sfu/README.md
index b53285b..2a4b00a 100644
--- a/examples/sfu/README.md
+++ b/examples/sfu/README.md
@@ -20,12 +20,21 @@
 3. Open `/app/androidcast_project/sfu/lab` → publish screen share.
 4. Second tab/browser → same lab URL → enter room id + **publisher feed id** → Subscribe.
 
-## Next (M2+)
+## Milestones
 
-1. Wire cast encoder → SFU publisher (screen share, not camera-only lab).
-2. Education screen share on SFU path (replace P2P demo).
+| Milestone | Scope |
+|-----------|--------|
+| **M0** | Browser lab (`lab.php`) — getDisplayMedia publish + subscribe |
+| **M1** | Android libwebrtc camera publish/subscribe (dev gate) |
+| **M2** | Android MediaProjection screen share + ICE from health (coturn) |
+| **M3+** | Cast encoder → SFU transport; education path; RBAC stats |
+
+## Next (M3+)
+
+1. Wire cast encoder → SFU publisher (replace P2P cast transport).
+2. Education screen share on SFU path.
 3. Session RBAC + stats → graphs.
 
-Android M1: `ac-mobile-android` → Developer settings → **Enable Janus SFU relay lab** → **Open SFU lab**.
+Android: **Developer settings → Enable Janus SFU relay lab → Open SFU lab** — **Publish screen share** (M2) or **Publish camera** (M1).
 
 See [ac-docs BUILD_DEPLOY](../../ac-docs/BUILD_DEPLOY.md) and cluster `deploy-janus-sfu.sh`.
diff --git a/public/health.php b/public/health.php
index 45cbfeb..e280148 100644
--- a/public/health.php
+++ b/public/health.php
@@ -8,6 +8,22 @@ $janus  = janusClient();
 $info   = $janus->info();
 $online = isset($info['janus']) && $info['janus'] === 'server_info';
 
+$turnHost = trim((string) sfuConfig('turn_host', ''));
+$turnPort = (int) sfuConfig('turn_port', 3478);
+$turnUser = trim((string) sfuConfig('turn_user', ''));
+$turnPass = trim((string) sfuConfig('turn_pass', ''));
+$iceServers = [
+    ['urls' => 'stun:stun.l.google.com:19302'],
+    ['urls' => 'stun:stun1.l.google.com:19302'],
+];
+if ($turnHost !== '') {
+    $iceServers[] = [
+        'urls' => 'turn:' . $turnHost . ':' . $turnPort . '?transport=udp',
+        'username' => $turnUser,
+        'credential' => $turnPass,
+    ];
+}
+
 echo json_encode([
     'ok'    => true,
     'sfu'   => [
@@ -18,5 +34,7 @@ echo json_encode([
         'signaling_url'  => sfuConfig('signaling_url', 'wss://apps.f0xx.org/app/androidcast_project/sfu/ws'),
         'ws_url'         => '/app/androidcast_project/sfu/ws',
         'api_base'       => '/app/androidcast_project/sfu/api',
+        'ice_servers'    => $iceServers,
+        'turn_host'      => $turnHost !== '' ? $turnHost : null,
     ],
 ], JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);