Improve IKAR reliability, security, and Android UX

docker-compose.rpi5.yml

@@ -7,9 +7,57 @@ services:
       context: .
       dockerfile: Dockerfile.server
     restart: unless-stopped
+    stop_grace_period: 30s
+    user: "${IKAR_UID:-1000}:${IKAR_GID:-1000}"
     env_file:
       - .env.server
     ports:
       - "127.0.0.1:5099:5099"
     volumes:
       - ${IKAR_DATA_PATH:?IKAR_DATA_PATH must be set in .env}:/app/Data
+      - ${IKAR_BACKUP_PATH:-/mnt/data/ikar-backups}:/backups:ro
+    environment:
+      Backup__Directory: /backups
+      Backup__RequireFreshBackup: "true"
+      WebRtc__IceServers__0__Urls__0: stun:stun.l.google.com:19302
+      WebRtc__IceServers__1__Urls__0: turn:${TURN_HOST:-ikar.kusoft.xyz}:3478?transport=udp
+      WebRtc__IceServers__1__Urls__1: turn:${TURN_HOST:-ikar.kusoft.xyz}:3478?transport=tcp
+      WebRtc__IceServers__1__Username: ${TURN_USERNAME:?TURN_USERNAME must be set in .env}
+      WebRtc__IceServers__1__Credential: ${TURN_PASSWORD:?TURN_PASSWORD must be set in .env}
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    mem_limit: 768m
+    cpus: 2.0
+
+  ikar-turn:
+    container_name: ikar-turn
+    image: coturn/coturn:4.14.0-r0
+    platform: linux/arm64
+    restart: unless-stopped
+    network_mode: host
+    command:
+      - --no-cli
+      - --fingerprint
+      - --lt-cred-mech
+      - --realm=${TURN_REALM:-ikar.kusoft.xyz}
+      - --user=${TURN_USERNAME:?TURN_USERNAME must be set in .env}:${TURN_PASSWORD:?TURN_PASSWORD must be set in .env}
+      - --listening-ip=${TURN_PRIVATE_IP:?TURN_PRIVATE_IP must be set in .env}
+      - --relay-ip=${TURN_PRIVATE_IP:?TURN_PRIVATE_IP must be set in .env}
+      - --external-ip=${TURN_EXTERNAL_IP:?TURN_EXTERNAL_IP must be set in .env}/${TURN_PRIVATE_IP:?TURN_PRIVATE_IP must be set in .env}
+      - --listening-port=3478
+      - --min-port=49160
+      - --max-port=49200
+      - --no-tls
+      - --no-dtls
+      - --no-multicast-peers
+      - --log-file=stdout
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    mem_limit: 256m
+    cpus: 1.0