Support NAT media binding and cross-host reverse proxies

[imanYazizi]

Summary

• detect and persist the IPv4 address assigned to the BBB host
• bind WebRTC SFU and coturn relay traffic to that internal address while announcing the public address
• add an opt-in nginx bind address for a reverse proxy running on another host
• preserve the external proxy's HTTPS scheme when forwarding requests to Greenlight
• replace the obsolete NAT workaround with the actual .env, firewall, and regeneration workflow

Problem

EXTERNAL_IPv4 is currently used as both the announced and listening address for WebRTC SFU and coturn. On a host behind 1:1 or port-forwarding NAT, the public address is not assigned to a local interface. The web application remains reachable, but media services cannot bind or produce usable ICE candidates, so microphone and camera connections stall or fail.

A reverse proxy on another machine has a related deployment gap: nginx port 48087 is published only on loopback and the Docker bridge. Manually publishing it solves reachability, but the inner nginx configuration then replaces X-Forwarded-Proto: https with its local HTTP scheme when proxying Greenlight.

Related reports: #104, #117, and #270.

How this fixes deployment

scripts/setup now detects the source address of the host's default IPv4 route and stores it as INTERNAL_IPv4. The generated Compose configuration uses:

• INTERNAL_IPv4 as the WebRTC SFU listening address
• EXTERNAL_IPv4 as the SFU announced address
• coturn's public/private external-address mapping with relay traffic bound to INTERNAL_IPv4

For existing .env files, Compose generation falls back to EXTERNAL_IPv4, preserving the current behavior on directly connected hosts.

NGINX_BIND_IP is optional and empty by default. Operators with a reverse proxy on another host can bind only 48087 to a reachable host address and restrict that port to the proxy at the firewall. Nginx honors an incoming HTTPS forwarded scheme while retaining $scheme as the fallback.

IPv6 behavior is unchanged.

Validation

• git diff --check
• bash -n scripts/setup scripts/generate-compose
• confirmed the patch contains no deployment-specific addresses or credentials
• the same SFU listening/announcement, coturn NAT mapping, and forwarded-scheme behavior was verified on a BBB 3.0.23 deployment behind router NAT and an external Nginx Proxy Manager, including successful microphone and camera participation