net/turnserver: Update 4.14.0 => 4.16.0

Port changes:
- Run turnserver as non-root by default.
- Pet port(lint|fmt|clippy).

PR:		297251, 296810
Reported by:	Frank Wall <freebsd@moov.de>
Reported by	Zixu Wu <zx@bv3.dev>
Approved by:	Chris Hutchinson <portmaster@bsdforge.com> (maintainer)
Approved by:	osa, vvd (Mentors, implicit)
Co-authored-by:	Frank Wall <freebsd@moov.de>
Co-authored-by:	Zixu Wu <zx@bv3.dev>
Security:	GHSA-5538-7cxj-5jcc
MFH:		2026Q3

6 files changed, 73 insertions, 51 deletions

diff --git a/GIDs b/GIDs
index 54526684dc95..f035f3924909 100644
--- a/GIDs
+++ b/GIDs
@@ -333,7 +333,7 @@ autopulse:*:388:
 ldap:*:389:
 bunkerweb:*:390:
 dirsrv:*:391:
-# free: 392
+_turnserver:*:392:
 # free: 393
 # free: 394
 # free: 395
diff --git a/UIDs b/UIDs
index 9ccae2d4f048..f460c3b88c80 100644
--- a/UIDs
+++ b/UIDs
@@ -338,7 +338,7 @@ autopulse:*:388:388::0:0:Autopulse Daemon:/nonexistent:/usr/sbin/nologin
 ldap:*:389:389::0:0:OpenLDAP Server:/nonexistent:/usr/sbin/nologin
 bunkerweb:*:390:390::0:0:Bunkerweb Service:/nonexistent:/usr/sbin/nologin
 dirsrv:*:391:391::0:0:389 Directory Server:/usr/local/share/dirsrv:/usr/sbin/nologin
-# free: 392
+_turnserver:*:392:392::0:0:Coturn Turnserver Daemon:/nonexistent:/usr/sbin/nologin
 # free: 393
 # free: 394
 # free: 395
diff --git a/net/turnserver/Makefile b/net/turnserver/Makefile
index 573fe66f066a..a0e2e5be976d 100644
--- a/net/turnserver/Makefile
+++ b/net/turnserver/Makefile
@@ -1,5 +1,5 @@
 PORTNAME=	turnserver
-DISTVERSION=	4.14.0
+DISTVERSION=	4.16.0
 CATEGORIES=	net
 MASTER_SITES=	https://coturn.net/turnserver/extradocs/:xdocs
 DISTFILES=	turn.extra.docs-2.0.0.1.tar.gz:xdocs
@@ -22,75 +22,89 @@ USE_RC_SUBR=	turnserver
 SHEBANG_FILES=	examples/scripts/restapi/shared_secret_maintainer.pl
 
 HAS_CONFIGURE=	yes
-CONFIGURE_ENV+=	PTHREAD_LIBS=-pthread TURN_DISABLE_RPATH=1
+CONFIGURE_ENV+=	PTHREAD_LIBS=-pthread \
+		TURN_DISABLE_RPATH=1
 # MongoDB support is disabled until devel/mongo-c-driver is updated
 CONFIGURE_ENV+=	TURN_NO_MONGO=1
 
 TEST_TARGET=	test
 
 SUB_FILES=	pkg-message
+SUB_LIST=	GROUP=${GROUPS} \
+		USER=${USERS}
+
+USERS=		_turnserver
+GROUPS=		_turnserver
 
 MANPAGES=	turnserver.1 turnadmin.1 turnutils.1 turnutils_peer.1 \
 		turnutils_stunclient.1 turnutils_uclient.1 coturn.1 \
 		turnutils_oauth.1 turnutils_natdiscovery.1
 
-DOCS=	html TurnNetworks.pdf
-PORTREADMEDOCS=	LICENSE README.turnserver README.turnadmin README.turnutils INSTALL
-PORTDOCS=	${DOCS} ${PORTREADMEDOCS} postinstall.txt schema.sql schema.mongo.sh \
-		schema.userdb.redis schema.stats.redis
+DOCS=		html TurnNetworks.pdf
+PORTREADMEDOCS=	LICENSE README.turnserver README.turnadmin README.turnutils \
+		INSTALL
+PORTDOCS=	${DOCS} ${PORTREADMEDOCS} postinstall.txt schema.mongo.sh \
+		schema.sql schema.stats.redis schema.userdb.redis
 
 _BIN_UTILS=	peer stunclient uclient oauth natdiscovery
 
-_ETC_EXAMPLES=	turnserver.conf turn_client_cert.pem \
-		turn_client_pkey.pem turn_server_cert.pem turn_server_pkey.pem
-_SCRIPT_EXAMPLES=	peer.sh	\
-	basic/relay.sh basic/dos_attack.sh \
-	basic/tcp_client_c2c_tcp_relay.sh basic/udp_c2c_client.sh \
-	basic/udp_client.sh basic/tcp_client.sh \
-	loadbalance/master_relay.sh loadbalance/slave_relay_1.sh loadbalance/slave_relay_2.sh \
-	loadbalance/udp_c2c.sh loadbalance/tcp_c2c_tcp_relay.sh \
-	longtermsecure/secure_dtls_client.sh longtermsecure/secure_relay.sh \
-	longtermsecure/secure_tls_client_cert.sh longtermsecure/secure_dtls_client_cert.sh \
-	longtermsecure/secure_relay_cert.sh \
-	longtermsecure/secure_tcp_client_c2c_tcp_relay.sh longtermsecure/secure_tcp_client.sh \
-	longtermsecure/secure_tls_client_c2c_tcp_relay.sh longtermsecure/secure_tls_client.sh \
-	longtermsecure/secure_udp_c2c.sh longtermsecure/secure_udp_client.sh \
-	longtermsecure/secure_sctp_client.sh \
-	longtermsecure/secure_dos_attack.sh \
-	longtermsecuredb/secure_relay_with_db_psql.sh \
-	longtermsecuredb/secure_relay_with_db_mysql.sh \
-	longtermsecuredb/secure_relay_with_db_mysql_ssl.sh \
-	longtermsecuredb/secure_relay_with_db_mongo.sh \
-	longtermsecuredb/secure_relay_with_db_redis.sh \
-	longtermsecuredb/secure_relay_with_db_sqlite.sh \
-	restapi/secure_relay_secret.sh \
-	restapi/secure_relay_secret_with_db_mysql.sh \
-	restapi/secure_relay_secret_with_db_psql.sh \
-	restapi/secure_relay_secret_with_db_redis.sh \
-	restapi/secure_relay_secret_with_db_mongo.sh \
-	restapi/secure_relay_secret_with_db_sqlite.sh \
-	restapi/secure_udp_client_with_secret.sh \
-	restapi/secure_relay_secret_with_db_psql.sh \
-	restapi/shared_secret_maintainer.pl \
-	selfloadbalance/secure_dos_attack.sh \
-	selfloadbalance/secure_relay.sh
+_ETC_EXAMPLES=		turnserver.conf turn_client_cert.pem \
+			turn_client_pkey.pem turn_server_cert.pem \
+			turn_server_pkey.pem
+_SCRIPT_EXAMPLES=	peer.sh basic/relay.sh basic/dos_attack.sh \
+			basic/tcp_client_c2c_tcp_relay.sh \
+			basic/udp_c2c_client.sh basic/udp_client.sh \
+			basic/tcp_client.sh loadbalance/master_relay.sh \
+			loadbalance/slave_relay_1.sh \
+			loadbalance/slave_relay_2.sh loadbalance/udp_c2c.sh \
+			loadbalance/tcp_c2c_tcp_relay.sh \
+			longtermsecure/secure_dtls_client.sh \
+			longtermsecure/secure_relay.sh \
+			longtermsecure/secure_tls_client_cert.sh \
+			longtermsecure/secure_dtls_client_cert.sh \
+			longtermsecure/secure_relay_cert.sh \
+			longtermsecure/secure_tcp_client_c2c_tcp_relay.sh \
+			longtermsecure/secure_tcp_client.sh \
+			longtermsecure/secure_tls_client_c2c_tcp_relay.sh \
+			longtermsecure/secure_tls_client.sh \
+			longtermsecure/secure_udp_c2c.sh \
+			longtermsecure/secure_udp_client.sh \
+			longtermsecure/secure_sctp_client.sh \
+			longtermsecure/secure_dos_attack.sh \
+			longtermsecuredb/secure_relay_with_db_psql.sh \
+			longtermsecuredb/secure_relay_with_db_mysql.sh \
+			longtermsecuredb/secure_relay_with_db_mysql_ssl.sh \
+			longtermsecuredb/secure_relay_with_db_mongo.sh \
+			longtermsecuredb/secure_relay_with_db_redis.sh \
+			longtermsecuredb/secure_relay_with_db_sqlite.sh \
+			restapi/secure_relay_secret.sh \
+			restapi/secure_relay_secret_with_db_mysql.sh \
+			restapi/secure_relay_secret_with_db_psql.sh \
+			restapi/secure_relay_secret_with_db_redis.sh \
+			restapi/secure_relay_secret_with_db_mongo.sh \
+			restapi/secure_relay_secret_with_db_sqlite.sh \
+			restapi/secure_udp_client_with_secret.sh \
+			restapi/secure_relay_secret_with_db_psql.sh \
+			restapi/shared_secret_maintainer.pl \
+			selfloadbalance/secure_dos_attack.sh \
+			selfloadbalance/secure_relay.sh
 
-OPTIONS_DEFINE=	DOCS EXAMPLES MYSQL PGSQL REDIS SQLITE
+OPTIONS_DEFINE=		DOCS EXAMPLES MYSQL PGSQL REDIS SQLITE
 OPTIONS_DEFAULT=	MYSQL PGSQL REDIS SQLITE
-OPTIONS_SUB=	yes
+OPTIONS_SUB=		yes
 
 REDIS_DESC=	Redis support for user database and for status and statistics reporting
 
-MYSQL_USES=	mysql
+MYSQL_USES=			mysql
 MYSQL_CONFIGURE_ENV_OFF=	TURN_NO_MYSQL=1
 
-PGSQL_USES=	pgsql
+PGSQL_USES=			pgsql
 PGSQL_CONFIGURE_ENV_OFF=	TURN_NO_PQ=1
 
-REDIS_LIB_DEPENDS=	libhiredis.so:databases/hiredis
+REDIS_LIB_DEPENDS=		libhiredis.so:databases/hiredis
 REDIS_CONFIGURE_ENV_OFF=	TURN_NO_HIREDIS=1
 
-SQLITE_USES=	sqlite
+SQLITE_USES=			sqlite
 SQLITE_CONFIGURE_ENV_OFF=	TURN_NO_SQLITE=1
 
 do-install:
diff --git a/net/turnserver/distinfo b/net/turnserver/distinfo
index 90ab33895e25..9a46d7eb91ef 100644
--- a/net/turnserver/distinfo
+++ b/net/turnserver/distinfo
@@ -1,5 +1,5 @@
 TIMESTAMP = 1783348674
 SHA256 (turn.extra.docs-2.0.0.1.tar.gz) = 3a86600fd0a30ce7aeb547e80402ce68ea9959f7dd58697e5b47fda6e33ab9ce
 SIZE (turn.extra.docs-2.0.0.1.tar.gz) = 485379
-SHA256 (coturn-coturn-4.14.0_GH0.tar.gz) = dc575988326274eb46256b04ef8dad698df8c8e053a35d9e5596fa8f2208bf81
-SIZE (coturn-coturn-4.14.0_GH0.tar.gz) = 712150
+SHA256 (coturn-coturn-4.16.0_GH0.tar.gz) = 4782c1560c2dfa4697dd3fbd85f2f8b506beb48f1d738351464300ef1e294760
+SIZE (coturn-coturn-4.16.0_GH0.tar.gz) = 788671
diff --git a/net/turnserver/files/pkg-message.in b/net/turnserver/files/pkg-message.in
index b7e20aed04dd..0accf031a2ae 100644
--- a/net/turnserver/files/pkg-message.in
+++ b/net/turnserver/files/pkg-message.in
@@ -39,6 +39,10 @@ The TURN Server supports (optionally) SQLite, MySQL, PostgreSQL, Redis.
    $ man turnserver
    $ man turnadmin
    $ man turnutils
+
+Please be aware that running as non-root user may require additional
+workarounds on FreeBSD, as suggested by this bug report:
+https://github.com/coturn/coturn/issues/1098
 EOM
 }
 ]
diff --git a/net/turnserver/files/turnserver.in b/net/turnserver/files/turnserver.in
index 8d82fc8e9b8c..2b0bcd5354d4 100644
--- a/net/turnserver/files/turnserver.in
+++ b/net/turnserver/files/turnserver.in
@@ -11,6 +11,8 @@
 #				Set it to YES to enable turnserver.
 # turnserver_config (path):	Set to %%PREFIX%%/etc/turnserver.conf
 #				by default.
+# turnserver_user (str):	Set to %%USER%% by default.
+# turnserver_group (str):	Set to %%GROUP%% by default.
 
 . /etc/rc.subr
 
@@ -19,8 +21,10 @@ rcvar=turnserver_enable
 
 load_rc_config $name
 
-: ${turnserver_enable:=no}
-: ${turnserver_config=%%PREFIX%%/etc/turnserver.conf}
+: ${turnserver_enable:="NO"}
+: ${turnserver_config="%%PREFIX%%/etc/turnserver.conf"}
+: ${turnserver_user:="%%USER%%"}
+: ${turnserver_group:="%%GROUP%%"}
 
 command="%%PREFIX%%/bin/${name}"
 command_args="--daemon -c ${turnserver_config}"