feat: add guarded webrtc node transport

pkg/config/config.go

@@ -299,8 +299,9 @@ type GatewayNodesConfig struct {
 }
 
 type GatewayNodesP2PConfig struct {
-	Enabled   bool   `json:"enabled"`
-	Transport string `json:"transport,omitempty"`
+	Enabled     bool     `json:"enabled"`
+	Transport   string   `json:"transport,omitempty"`
+	STUNServers []string `json:"stun_servers,omitempty"`
 }
 
 type CronConfig struct {
@@ -546,8 +547,9 @@ func DefaultConfig() *Config {
 			Token: generateGatewayToken(),
 			Nodes: GatewayNodesConfig{
 				P2P: GatewayNodesP2PConfig{
-					Enabled:   false,
-					Transport: "websocket_tunnel",
+					Enabled:     false,
+					Transport:   "websocket_tunnel",
+					STUNServers: []string{},
 				},
 			},
 		},

pkg/config/validate.go

@@ -124,6 +124,7 @@ func Validate(cfg *Config) []error {
 	default:
 		errs = append(errs, fmt.Errorf("gateway.nodes.p2p.transport must be one of: websocket_tunnel, webrtc"))
 	}
+	errs = append(errs, validateNonEmptyStringList("gateway.nodes.p2p.stun_servers", cfg.Gateway.Nodes.P2P.STUNServers)...)
 	if cfg.Cron.MinSleepSec <= 0 {
 		errs = append(errs, fmt.Errorf("cron.min_sleep_sec must be > 0"))
 	}