Few debian updates #5729

damencho · 2020-04-06T21:27:16Z

No description provided.

damencho · 2020-04-06T22:30:30Z

turnserver still does not work on Debian10 because of permissions ... #5714

damencho · 2020-04-06T22:37:11Z

I will push that commit from the other PR here just to test it.

damencho · 2020-04-07T03:11:41Z

Finally I made it work :)

damencho · 2020-04-07T03:16:08Z

@saghul I think this and the meta-package PR are all the known problems so far fixed. I was able to repro several times the re-ordering of the installing packets on Debian10 and with these PRs it is fixed.
Also, I tested with apache, with Nginx already listening on 443 ... and we don't need --no-recommends instructions no more.

saghul

LGTM! Question: didn’t we want to drop support for prosody-trunk?

paulmenzel · 2020-04-07T07:05:53Z

Commit debian: Update coturn udp port to non-privileged one. misses the explanation, why this change is good. The whole point of using the TURN server Coturn is for users behind Firewalls with only ports 80 and 443 open, isn’t it?

saghul · 2020-04-07T07:17:16Z

The whole point of using the TURN server Coturn is for users behind Firewalls with only ports 80 and 443 open, isn’t it?

No, it isn't. If 2 participants are behind symmetric NATs they will need TURN to etablish a P2P session.

The reuse of ports 80 / 443 is is indeed nice to try and circumvent spartan firewalls, but the problem here is that Debian 10 doesn't have the capability to bind to priviledged ports set on their unit file, and hacking it ourselves is just not nice.

This is just our default, you are welcome to make changes to your installation of course.

paulmenzel · 2020-04-07T07:59:11Z

I’d prefer if the scripts would create a drop-in snippet for Coturn.

$ cat /etc/systemd/system/turnserver.service.d/allow-bind-443.conf
[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE

(systemctl edit coturn.service would be for manually creating the drop-in.)

saghul · 2020-04-07T08:04:58Z

We have spent countless hours trying to get this right, we'll just land it as is.

paulmenzel · 2020-04-07T08:16:34Z

I am sorry, that you had to spend so much time with this, and thank you for supporting Jitsi users.

What is the actual problem of sharing the port? The commit message and pull request description do not mention this.

julienfastre · 2020-04-07T08:35:45Z

The issue is here: #5529

TLDR: There are two problems:

the turnserver user does not have any permission to bind on port 443/udp (because this is a privilegied port) ;
the turnserver user does not have sufficient permissions to read the letsencrypt certificates.

paulmenzel · 2020-04-07T08:39:55Z

doc/debian/jitsi-meet-turn/coturn-certbot-deploy.sh

+
+# create a directory to store certs if it does not exists
+if [ ! -d "$COTURN_CERT_DIR" ]; then
+	mkdir -p /etc/coturn/certs


Use the variable COTURN_CERT_DIR here?

paulmenzel · 2020-04-07T08:42:34Z

doc/debian/jitsi-meet-turn/coturn-certbot-deploy.sh

+
+for domain in $RENEWED_DOMAINS; do
+        case $domain in
+        jitsi-meet.example.com)


Add a comment that this is updated/replaced with the correct domain by the install script?

paulmenzel · 2020-04-07T08:45:16Z

The issue is here: #5529

TLDR: There are two problems:

Thank you for the summary.

* the `turnserver` user does not have any permission to bind on port 443/udp (because this is a privilegied port) ;

Instead of changing to an unprivileged port, I am proposing to extend Coturn’s service unit to give the needed capability to bind to a privileged port to keep “The reuse of ports 80 / 443 is is indeed nice to try and circumvent spartan firewalls,” working.

* the `turnserver` user does not have sufficient permissions to read the letsencrypt certificates.

Yes, fixed by commit add scripts for deploying coturn with certbot.

saghul · 2020-04-07T15:21:25Z

What is the actual problem of sharing the port? The commit message and pull request description do not mention this.

The problem is not with sharing, it's with coturn not being able to bind to a priviledged port by default, on Debian 10. This is not the case on Ubuntu for example.

damencho · 2020-04-08T03:02:38Z

Oh, there are more cases here with this turn ... if we skip its configuration, actually it is installed ... we may need to just configure it on another port (change prosody config) ...

paulmenzel · 2020-04-08T06:34:55Z

Oh, there are more cases here with this turn ...

Do you mean problems? Which are those?

if we skip its configuration, actually it is installed ...

What do you mean? The package coturn was always installed, wasn’t it?

we may need to just configure it on another port (change prosody config) ...

Why? To fix what problems?

PS: It’s quite hard to help in any way with these terse (short) comments.

damencho · 2020-04-08T12:25:07Z

Yeah, sorry for those. They were more like self note and @saul notes.

Even when we skip configuring coturn it is installed as it is dependency of this package. And we still advertise it.
So what I was thinking last night is to always configuure it and depending on whether there is another nginx site listening on 443 either multiplex or configure coturn and advertise the non 4443 port and for tcp and add instructions the this port may need port forwarding.

damencho · 2020-04-08T12:46:24Z

I was also to leave and coturn and for apache on the non standard port.

damencho · 2020-04-08T15:02:17Z

I did a few more changes. Hope those are the last one. I will be testing those now.

damencho · 2020-04-08T15:29:05Z

Jenkins, skip ci.

damencho · 2020-04-08T17:11:05Z

@paulmenzel I think everything is covered now. If you can take a look. @saghul will also take a look and approve. But I think this is it and this will go to stable fixing all discovered issues with the packaging.

saghul

Awesome work @damencho !

* debian: Update coturn udp port to non-privileged one. * debian: Turnserver config requires jitsi-meet-web-config files. * doc: Updates doc, removing `--no-install-recommends`. * debian: Moves checks and configs to default to prosody 0.11. * debian: Disable room locking on internal muc. * add scripts for deploying coturn with certbot * turnserver: Removes unused variable showing error. * debian: updates let's encrypt and coturn scripts. * debian: Detect failure to retrieve external ip address. * debian: Always configure turn when the turnserver package is installed. Co-authored-by: Julien Fastré <[email protected]>

Yetangitu · 2020-04-17T22:35:22Z

Please have a look at my comment in the 'Move UDP port to 4446' thread: #5714 (comment)

STUN and TURN have officially designated ports, 3478 and (TLS) 5349. Some sites already have turn/stun-servers and the accompanying router and firewall configurations, generally set for those official ports. I suggest using these ports instead of 4446/4445.

I just submitted a PR for this: #6172

damencho · 2020-04-17T22:57:55Z

We are discussing this already, to drop the nginx multiplexing and just leave a documentation how to do it. And when this happen we will install and configure turnserver by default even with apache and leave ports on their defaults. We just haven't been able to work on that.

RubensRainelli · 2020-04-28T20:02:20Z

@damencho please fix it ASAP since it broke me 2 servers while reloading NGINX

damencho · 2020-04-28T20:49:43Z

What did broke is more important, as it should not break anything at the moment.

RubensRainelli · 2020-04-29T00:40:02Z

And it will break if I didn't made my own fix xD

damencho · 2020-04-29T02:08:19Z

The current stable detects and if there is already a host listening to 443 the multiplexing is skipped.

paulmenzel · 2020-04-29T09:31:56Z

@RubensRainelli, can you please create an issue with more context and refer to this merge/pull request as the “culprit”?

damencho added 5 commits April 3, 2020 12:49

debian: Update coturn udp port to non-privileged one.

41ba6b1

debian: Turnserver config requires jitsi-meet-web-config files.

961820b

doc: Updates doc, removing --no-install-recommends.

18fd4b3

debian: Moves checks and configs to default to prosody 0.11.

be5414a

debian: Disable room locking on internal muc.

48cdc66

damencho requested a review from saghul April 6, 2020 21:27

add scripts for deploying coturn with certbot

d6b2718

turnserver: Removes unused variable showing error.

96a048e

damencho force-pushed the deb-up branch from 51ed33e to 379c0f6 Compare April 7, 2020 02:35

debian: updates let's encrypt and coturn scripts.

d82162c

damencho force-pushed the deb-up branch from 379c0f6 to d82162c Compare April 7, 2020 03:02

damencho mentioned this pull request Apr 7, 2020

service jitsi-videobridge2, not jitsi-videobridge #5652

Closed

saghul previously approved these changes Apr 7, 2020

View reviewed changes

saghul closed this Apr 7, 2020

saghul reopened this Apr 7, 2020

This was referenced Apr 7, 2020

Move the coturn udp port to 4446 and add script for deploying coturn certificates with certbot #5714

Closed

On Debian Buster, fresh install, coturn server fails to start #5529

Closed

paulmenzel reviewed Apr 7, 2020

View reviewed changes

damencho dismissed saghul’s stale review via 02798ad April 7, 2020 15:17

saghul previously approved these changes Apr 7, 2020

View reviewed changes

debian: Detect failure to retrieve external ip address.

ac893e3

damencho dismissed saghul’s stale review via 3cdab51 April 8, 2020 15:01

damencho force-pushed the deb-up branch from 02798ad to 3cdab51 Compare April 8, 2020 15:01

damencho force-pushed the deb-up branch from 979759d to fbe860d Compare April 8, 2020 15:52

debian: Always configure turn when the turnserver package is installed.

1c7531f

damencho force-pushed the deb-up branch from fbe860d to 1c7531f Compare April 8, 2020 17:08

saghul approved these changes Apr 8, 2020

View reviewed changes

damencho merged commit ffdd4f2 into master Apr 8, 2020

damencho deleted the deb-up branch April 8, 2020 18:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Few debian updates #5729

Few debian updates #5729

damencho commented Apr 6, 2020

damencho commented Apr 6, 2020

damencho commented Apr 6, 2020

damencho commented Apr 7, 2020

damencho commented Apr 7, 2020

saghul left a comment

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

paulmenzel commented Apr 7, 2020

julienfastre commented Apr 7, 2020

paulmenzel Apr 7, 2020

paulmenzel Apr 7, 2020

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

damencho commented Apr 8, 2020

paulmenzel commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

saghul left a comment

Yetangitu commented Apr 17, 2020 •

edited

Loading

damencho commented Apr 17, 2020

RubensRainelli commented Apr 28, 2020

damencho commented Apr 28, 2020

RubensRainelli commented Apr 29, 2020

damencho commented Apr 29, 2020

paulmenzel commented Apr 29, 2020

Few debian updates #5729

Few debian updates #5729

Conversation

damencho commented Apr 6, 2020

damencho commented Apr 6, 2020

damencho commented Apr 6, 2020

damencho commented Apr 7, 2020

damencho commented Apr 7, 2020

saghul left a comment

Choose a reason for hiding this comment

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

paulmenzel commented Apr 7, 2020

julienfastre commented Apr 7, 2020

paulmenzel Apr 7, 2020

Choose a reason for hiding this comment

paulmenzel Apr 7, 2020

Choose a reason for hiding this comment

paulmenzel commented Apr 7, 2020

saghul commented Apr 7, 2020

damencho commented Apr 8, 2020

paulmenzel commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

damencho commented Apr 8, 2020

saghul left a comment

Choose a reason for hiding this comment

Yetangitu commented Apr 17, 2020 • edited Loading

damencho commented Apr 17, 2020

RubensRainelli commented Apr 28, 2020

damencho commented Apr 28, 2020

RubensRainelli commented Apr 29, 2020

damencho commented Apr 29, 2020

paulmenzel commented Apr 29, 2020

Yetangitu commented Apr 17, 2020 •

edited

Loading