feat: configurable STUN server fallbacks for WebRTC ICE

The WebRTC transport relied on a single Google STUN server — if it was
unreachable, ICE gathering waited the full 4s timeout. Now four public
servers are used by default (Google ×2, Cloudflare, Mozilla), configurable
via node.toml, the Node page UI, and the CLI (meshbay-node stun list|add|
remove|reset). Changes are hot-swapped on the live transport.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

10 files changed, 140 insertions, 0 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
index 86258d6..604be3c 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/de.js
@@ -743,4 +743,18 @@ export default {
   'wizard.done_message': 'Ihre Gruppe ist bereit. Ihr Node hostet sie und die Verschlüsselung ist eingerichtet.',
   'wizard.go_to_group': 'Zur Gruppe',
   'wizard.finish_later': 'Einrichtung später abschließen',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
index 5d2725c..a58619e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/en.js
@@ -722,4 +722,18 @@ export default {
   'node.setting_unit_minutes': 'min',
   'node.setting_on': 'On',
   'node.setting_off': 'Off',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
index 7080677..bcb0b93 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/es.js
@@ -739,4 +739,18 @@ export default {
   'wizard.done_message': 'Su grupo está listo. Su node lo aloja y el cifrado está configurado.',
   'wizard.go_to_group': 'Ir al grupo',
   'wizard.finish_later': 'Finalizar configuración más tarde',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
index eee4292..2e3e4d6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/fr.js
@@ -755,4 +755,18 @@ export default {
   'wizard.done_message': 'Votre groupe est prêt. Votre node l\'héberge et le chiffrement est configuré.',
   'wizard.go_to_group': 'Aller au groupe',
   'wizard.finish_later': 'Terminer la configuration plus tard',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
index 1031fed..dc1d16f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/it.js
@@ -753,4 +753,18 @@ export default {
   'wizard.done_message': 'Il suo gruppo è pronto. Il suo node lo ospita e la cifratura è configurata.',
   'wizard.go_to_group': 'Vai al gruppo',
   'wizard.finish_later': 'Completa la configurazione in seguito',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
index 39863b1..90a5f24 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/ja.js
@@ -737,4 +737,18 @@ export default {
   'wizard.done_message': 'グループの準備ができました。node がホストし、暗号化が設定されています。',
   'wizard.go_to_group': 'グループを開く',
   'wizard.finish_later': 'セットアップを後で完了',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
index 21d14d7..3347087 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/nl.js
@@ -755,4 +755,18 @@ export default {
   'wizard.done_message': 'Uw groep is klaar. Uw node host de groep en de versleuteling is ingesteld.',
   'wizard.go_to_group': 'Naar groep',
   'wizard.finish_later': 'Later voltooien',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
index d6ca6af..499a54f 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pl.js
@@ -782,4 +782,18 @@ export default {
   'wizard.done_message': 'Grupa jest gotowa. Node ją hostuje, a szyfrowanie jest skonfigurowane.',
   'wizard.go_to_group': 'Przejdź do grupy',
   'wizard.finish_later': 'Dokończ konfigurację później',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
index 5e6dd42..03a9f6e 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/pt-BR.js
@@ -740,4 +740,18 @@ export default {
   'wizard.done_message': 'Seu grupo está pronto. Seu node o está hospedando e a criptografia está configurada.',
   'wizard.go_to_group': 'Ir para o grupo',
   'wizard.finish_later': 'Finalizar configuração depois',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
index da97162..8004868 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/locales/zh-CN.js
@@ -724,4 +724,18 @@ export default {
   'wizard.done_message': '您的群组已就绪。您的 node 正在托管它，加密已设置完成。',
   'wizard.go_to_group': '前往群组',
   'wizard.finish_later': '稍后完成设置',
+  'node.stun_servers': 'STUN Servers',
+  'node.stun_hint': 'Servers used for WebRTC NAT traversal (ICE candidate gathering).',
+  'node.stun_add': 'Add',
+  'node.stun_add_placeholder': 'stun:host:port',
+  'node.stun_remove': 'Remove',
+  'node.stun_move_up': 'Move up',
+  'node.stun_move_down': 'Move down',
+  'node.stun_save': 'Save',
+  'node.stun_saving': 'Saving…',
+  'node.stun_saved': 'STUN servers saved.',
+  'node.stun_reset': 'Reset to defaults',
+  'node.stun_empty': 'No STUN servers configured. NAT traversal will not work.',
+  'node.stun_duplicate': 'This server is already in the list.',
+  'node.stun_invalid': 'STUN URL must start with stun:',
 };